Description:
------------
When array_walk function is used inside __construct function of an object, array_walk allows passing of its third parameter to the user defined function by reference.  This is expected.

In any other case, function, or scope, this parameter cannot be passed by reference, instead passing by value yet producing no error even when the user defined function demands passing this third parameter by reference.  Possibly similar to bug 45780, but unlikely due to function scope behaviour.

Testing on php 5.2.4 (cvs/snap unknown); apache 2.2; ubuntu 8.04 server.  PHP packaged with ubuntu 8.04 lamp.

Reproduce code:
---------------
<?php

class ClassTest {
	public $val_1 = null;
	public $val_2 = null;

	function __construct($array) {
		$class_test_array = array("val_1" => 1, "val_2" => 2, "val_3" => 3);
		array_walk($class_test_array,create_function('$v,$k,&$that','if (property_exists($that,$k)) {$that->$k = $v;}'),$this);
		}

	}


function alter_test_array($val, $key, &$test_array) {
	$test_array[] = $val;
	}

$class_test_obj = new ClassTest();
$normal_test_array_1 = array(1,2,3);
$normal_test_array_2 = array();
$normal_test_array_3 = array();

array_walk($normal_test_array_1, create_function('$val,$key,&$test_array', '$test_array[] = $val;'), $normal_test_array_2);
array_walk($normal_test_array_1, alter_test_array, $normal_test_array_3);




Expected result:
----------------
$class_test_obj === object(1,2)
$normal_test_array_2 === array(1,2,3)
$normal_test_array_3 === array(1,2,3)

Actual result:
--------------
$class_test_obj === object(1,2)
$normal_test_array_2 === array(0)
$normal_test_array_3 === array(0)