There are lots of functions/codes doesn't check the return value of 
zend_hash_next_index_insert(and other variants of zend_hash_update_**).

So, IMO, there should be some familar issues there. 

if we only focus on this one, a simple patch will be(but I think it's no needed 
to fix this, since this really a intentional behavior :) thanks ):

Index: ext/standard/array.c
===================================================================
--- ext/standard/array.c	(revision 323122)
+++ ext/standard/array.c	(working copy)
@@ -1564,11 +1564,15 @@
 
 	num--;
 	zval_add_ref(&val);
-	zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, 
sizeof(zval *), NULL);
+	if (zend_hash_index_update(Z_ARRVAL_P(return_value), start_key, &val, 
sizeof(zval *), NULL) == FAILURE) {
+		zval_ptr_dtor(&val);
+	}
 
 	while (num--) {
 		zval_add_ref(&val);
-		zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, 
sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL_P(return_value), &val, 
sizeof(zval *), NULL) == FAILURE) {
+			zval_ptr_dtor(&val);
+		}
 	}
 }
 /* }}} */

hmm, I think I should fix this, since this was explored :)

Fixed in 5.3 , trunk, will close this after I meger this fix to 5.4.

This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.