Description:
------------
The documentation for call_user_func_array() makes no mention of pass-by-value / pass-by-reference (unlike call_user_func(), which is very clear on this subject).

This is significant because the behaviour of call_user_func_array() is not intuitive (see the user contributed notes on the documentation page: http://php.net/call_user_func_array ).

It appears that the way in which an argument is passed depends not on the target function signature, but rather on whether its entry in $param_arr is referenced or not.

Specifically, it is possible to force an argument to be passed by reference to a function which expects a pass-by-value argument, even with call time pass by reference DISABLED in php.ini.

See the reproduce code snippet for an example.

The most succinct way I'm able to express this is:
  "Regardless of the callback function's signature, any member of $param_arr that is referenced will be passed by reference and any member that is not reference will be passed by value."

I'm assuming this behaviour is intentional. If not I'll happily raise a scripting engine bug - let me know.

Reproduce code:
---------------
<?php
 function byRef(&$a, &$b) {
 	$a = 'changed';
 	$b = 'changed.b';
 }
 
 function byVal($a, $b) {
 	$a = 'changed.a';
 	$b = 'changed.b';
 }

 echo "\nForce a pass-by-reference function to take args by value:\n";
 $args = array('original.a', 'original.b');
 call_user_func_array('byRef', $args);
 var_dump($args);
 
 echo "\nForce a pass-by-Value function to take one arg by reference:\n";
 echo "NOTE: this works even with call time pass by reference DISABLED in php.ini:\n";
 $args = array('original.a', 'original.b');
 $ref = &$args[0];
 call_user_func_array('byVal', $args);
 var_dump($args); 
?>

Expected result:
----------------
Force a pass-by-reference function to take args by value:
array(2) {
  [0]=>
  string(10) "original.a"
  [1]=>
  string(10) "original.b"
}

Force a pass-by-Value function to take one arg by reference:
NOTE: this works even with call time pass by reference DISABLED in php.ini:
array(2) {
  [0]=>
  &string(9) "changed.a"
  [1]=>
  string(10) "original.b"
}

Actual result:
--------------
N/A