Please try using this snapshot:

  http://snaps.php.net/php5.4-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

I can not reproduce this in my environ, plz test with the svn-snap plz, thanks

I just tried it with php5.4-201109192030 on my Mac (Apache/2.2.17, Mac OS X 10.6.7) with the same result.

#0  0x00000001012e9e72 in _zend_hash_add_or_update (ht=0x10087d118, arKey=0x18 <Address 0x18 out of bounds>, nKeyLength=7, pData=0x7fff5fbff350, nDataSize=24, pDest=0x0, flag=1) at /Users/Grayling/php5.4-201109192030/Zend/zend_hash.c:268
#1  0x000000010139a944 in real_value_hnd (cmd=0x7fff5fbff820, dummy=0x10087d118, name=0x100890f58 "engine", value=<value temporarily unavailable, due to optimizations>, status=2) at /Users/Grayling/php5.4-201109192030/sapi/apache2handler/apache_config.c:73
#2  0x000000010139a9dd in real_flag_hnd (cmd=0x7fff5fbff820, dummy=0x10087d118, arg1=0x100890f58 "engine", arg2=0x100890f60 "off", status=2) at /Users/Grayling/php5.4-201109192030/sapi/apache2handler/apache_config.c:98
#3  0x0000000100003595 in invoke_cmd ()
#4  0x00000001000047d8 in ap_walk_config_sub ()
#5  0x000000010000488b in ap_walk_config ()
#6  0x0000000100005ddd in ap_process_config_tree ()
#7  0x000000010000a26a in main ()

this is so weird, since in the frame #0, the arkey is an invalid pointer, but it 
shoud be exactlly same as the name in #1, since I can not reproduce this in my 
environ,  could you do me a favor and try to find out the reason for how could 
this var be damaged?

you can try  to use gdb httpd, make a break point "b real_value_hnd", then exam it 
step by step, thanks

I tried what I could, but I don't know C or how to use gdb properly. It looks like var name makes it to _zend_hash_add_or_update intact as arKey, but then the address of arKey mysteriously changes inside that function.

Breakpoint 1, _zend_hash_add_or_update (ht=0x10087d120, arKey=0x10088e298 "engine", nKeyLength=7, pData=0x7fff5fbff330, nDataSize=24, pDest=0x0, flag=1) at /Users/Grayling/php5.4-201109192030/Zend/zend_hash.c:201
201		TSRMLS_FETCH();
(gdb) info args
ht = (HashTable *) 0x10087d120
arKey = 0x10088e298 "engine"
nKeyLength = 7
pData = (void *) 0x7fff5fbff330
nDataSize = 24
pDest = (void **) 0x0
flag = 1
(gdb) print arKey
$6 = 0x10088e298 "engine"
(gdb) print &arKey
Address requested for identifier "arKey" which is in register $r13
(gdb) info address arKey
Symbol "arKey" is 

   0x1012e9a70 - 0x1012e9a98: in register rsi
   0x1012e9a98 - 0x1012e9ace: in register r13
   0x1012e9ace - 0x1012e9b94: in register rcx
   0x1012e9b94 - 0x1012e9bc1: in register r13
   0x1012e9bc1 - 0x1012e9c7c: in register rcx
   0x1012e9c7c - 0x1012e9cd2: in register r13
   0x1012e9d7f - 0x1012e9d8a: in register r13
   0x1012e9d90 - 0x1012e9d9e: in register r13
   0x1012e9da4 - 0x1012e9dff: in register r13
   0x1012e9e2b - 0x1012e9f0f: in register r13
   0x1012e9f15 - 0x1012e9f45: in register r13
   0x1012e9fb5 - 0x1012e9fc6: in register r13
   0x1012e9fd9 - 0x1012e9ff1: in register r13
   0x1012ea00a - 0x1012ea02b: in register r13
   0x1012ea062 - 0x1012ea0b0: in register r13.

(gdb) next
(gdb) print arKey
$6 = 0x10088e298 "engine"
(gdb) p/x $rcx
$17 = 0x10088e298
[...]
(gdb) next    
278			case 6: hash = ((hash << 5) + hash) + *arKey++; /* fallthrough... */
(gdb) p/x $rcx
$18 = 0x10088e299
[...]
(gdb) next
283			case 1: hash = ((hash << 5) + hash) + *arKey++; break;
(gdb) p/x $rcx
$21 = 0x10088e29e
(gdb) print (char*)0x10088e29e
$22 = 0x10088e29e ""
(gdb) next
218		p = ht->arBuckets[nIndex];
(gdb) print arKey
$24 = 0x10088e29e ""
(gdb) p/x *arKey
$27 = 0x0
[...]
(gdb) next
Breakpoint 8, _zend_hash_add_or_update (ht=0x10087d120, arKey=0x10088e298 "engine", nKeyLength=7, pData=0x7fff5fbff330, nDataSize=24, pDest=0x0, flag=1) at /Users/Grayling/php5.4-201109192030/Zend/zend_hash.c:253
253			p = (Bucket *) pemalloc(sizeof(Bucket) + nKeyLength, ht->persistent);
(gdb) p/x *arKey
$32 = 0x65
(gdb) p/x $rcx
$33 = 0x10088e29e
(gdb) next
258			memcpy((char*)p->arKey, arKey, nKeyLength);
(gdb) p/x arKey
$41 = 0x10088e298
(gdb) print arKey
$42 = 0x10088e298 "engine"
[...]
(gdb) next
262		p->h = h;
(gdb) print arKey
$48 = 0x18 <Address 0x18 out of bounds>
(gdb) p/x arKey
$49 = 0x18
(gdb) print *p
$51 = {
  h = 0, 
  nKeyLength = 7, 
  pData = 0x100222bf0, 
  pDataPtr = 0x0, 
  pListNext = 0x200000000, 
  pListLast = 0x600000001, 
  pNext = 0x5000021000000010, 
  pLast = 0x0, 
  arKey = 0x100222be8 "engine"
}
[...]
(gdb) next

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x000000005448523c
0x00000001012e9e72 in _zend_hash_add_or_update (ht=0x10087d120, arKey=0x18 <Address 0x18 out of bounds>, nKeyLength=7, pData=0x7fff5fbff330, nDataSize=24, pDest=0x0, flag=1) at /Users/Grayling/php5.4-201109192030/Zend/zend_hash.c:268
268		HANDLE_BLOCK_INTERRUPTIONS();

I just tested upgrading from RC4 and the release version, and I no longer get a segfault when I do a config test or graceful/restart.