It survives because $x is static and each member in $x is a reference.

$x was initialized once to that range(1,3) array. Whenever f() returns it will return a copy of that array, thus $z and $y have both the same array values even though they are different actual arrays.
Modifying $y would have no effect on $z because of the copying... if it weren't for the by-ref foreach you did, which caused each member in the array to become a reference. That makes $x[2], $y[2], and $z[2] all the same so a change made to one of them will "appear" in the others.

The point isn't that $x survives, the point is that only the last element is a reference, and that it wasn't explicitly converted to a reference.

Set $y[1] to 'surprise' and then print out $z[1]: you'll get a result of 2.

Only the last element of $x is a reference after the foreach() has exited.

The bug is that the last element remains a reference after the referencing variable ($j) has for all intents and purposes ceased to exist.

For example, if you add an unset($j); after the foreach(), the issue disappears.

Poor phrasing on my part: each element *was* a reference, and when the loop moves to the next element the previous is destroyed. At the end the last element remains a reference.

However I'm also going along with previous decisions, such as bug #68402, which say that this behavior is not a bug. References can be tricky and unset()ing referenced variables when you're done with them is a good idea.