Description:
------------
This is constantly reproducible on PHP 5.4 (SVN r318919). It does not occur with 
PHP 5.3.

I am using the SilverStripe framework (http://silverstripe.org). The segfault is 
happening when trying to execute line 41 of 
sapphire/core/control/ContentController.php 
(http://svn.simon.geek.nz/silverstripe/sapphire/branches/2.4/core/control/Content
Controller.php, 
$dataRecord = new Page();)  when creating a new Signup controller by direct URL 
access (http://localhost/silverstripe/Signup).

The segfault also occurs when simulating a request using the cli (php 
sapphire/cli-script.php Signup). The backtrace provided is for this case.

Test script:
---------------
// Signup.php
<?php

class Signup extends LoginPage_Controller {}

// LoginPage.php
<?php

class LoginPage_Controller extends ContentController {
}

Expected result:
----------------
The page displays properly, as it does under PHP 5.3

Actual result:
--------------
Backtrace from gdb:
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x0000000100882248 in ZEND_FETCH_CLASS_SPEC_CONST_HANDLER 
(execute_data=0x1013a8220) at zend_vm_execute.h:1174
1174					CACHE_PTR(opline->op2.literal-
>cache_slot, EX_T(opline->result.var).class_entry);
(gdb) bt
#0  0x0000000100882248 in ZEND_FETCH_CLASS_SPEC_CONST_HANDLER 
(execute_data=0x1013a8220) at zend_vm_execute.h:1174
#1  0x000000010087bcf2 in execute (op_array=0x102229e38) at zend_vm_execute.h:410
#2  0x00000001008287fb in zend_execute_scripts (type=8, retval=0x0, file_count=3) 
at zend.c:1272
#3  0x000000010076b093 in php_execute_script (primary_file=0x7fff5fbff7f0) at 
main.c:2414
#4  0x00000001009fd9e3 in do_cli (argc=3, argv=0x7fff5fbffaa8) at php_cli.c:983
#5  0x00000001009ff725 in main (argc=3, argv=0x7fff5fbffaa8) at php_cli.c:1356

(gdb) p *opline->op2.literal
$2 = {
  constant = {
    value = {
      lval = 4317445712, 
      dval = 2.1331016040838005e-314, 
      str = {
        val = 0x10156fe50 "Page", 
        len = 4
      }, 
      ht = 0x10156fe50, 
      obj = {
        handle = 22478416, 
        handlers = 0x4
      }
    }, 
    refcount__gc = 2, 
    type = 6 '\006', 
    is_ref__gc = 1 '\001'
  }, 
  hash_value = 0, 
  cache_slot = 0
}