Description:
------------
if the $subject parameter's length exceeds 100009, str_replace has no return value.

This has been reproduced on windows 2003 with php 5.2.6 and Linux with php 5.2.5

PS:
If there is backslash in the $subject parameter and $pattern parameter, the critical poiont will change, the maximum string length to reproduce this bug will increase.

Reproduce code:
---------------
<?
$dummyText=str_pad("[start]",100016-strlen("[start][end]"),"*")."[end]";
str_replace_test($dummyText);
$dummyText=str_pad("[start]",100017-strlen("[start][end]"),"*")."[end]";
str_replace_test($dummyText);
function str_replace_test($dummyText){
	$result=preg_replace("/\[start\](.+?)\[end\]/eis","passed",$dummyText);
	$result==""?$result="failed":true;
	echo "str_replace with length: ".strlen($dummyText)." ".$result."<br>";
}
?>

Expected result:
----------------
str_replace with length: 100009 passed
str_replace with length: 100010 passed

Actual result:
--------------
str_replace with length: 100009 passed
str_replace with length: 100010 failed