Description:
------------
bug #29992 did not prove that the array was being modified by foreach, however this code does. According to var_dump() the last element starts as a "string" and after the foreach is a "reference to a string".

Reproduce code:
---------------
$foo = array('three', 'blind', 'mice');
var_dump($foo);
foreach($foo as &$elmnt){}
var_dump($foo);


Expected result:
----------------
array(3) {
  [0]=>
  string(5) "three"
  [1]=>
  string(5) "blind"
  [2]=>
  string(4) "mice"
}
array(3) {
  [0]=>
  string(5) "three"
  [1]=>
  string(5) "blind"
  [2]=>
  string(4) "mice"
}

Actual result:
--------------
array(3) {
  [0]=>
  string(5) "three"
  [1]=>
  string(5) "blind"
  [2]=>
  string(4) "mice"
}
array(3) {
  [0]=>
  string(5) "three"
  [1]=>
  string(5) "blind"
  [2]=>
  &string(4) "mice"
}