Description:
------------
Bug can be reproduced on almost any 7.* package and almost any OS.
Tested by myself on Ubuntu / FreeBSD / Windows on PHP package without additional modules.

Seems, that when you pass associative array element to any function/method, that require argument to be passed by reference, you get reference at passed array key instead of scalar/array/NULL value.

Didn't found at documentation anything about such conduct.

Test script:
---------------
<?php
// Can be any user or internal function (class method, e.t.c), accepting parameters by reference
function make_nothing(&$param) {}

$arr1 = ['val' => NULL];
$arr2 = ['val' => 5]; // instead "5" there can be any scalar/array/NULL
// Pass array element to function, that doing nothing
make_nothing($arr2['val']);
// ok, now we have reference instead of value
$arr1 = array_merge($arr1, $arr2);
var_dump($arr1, $arr2);

Expected result:
----------------
array(1) {
  ["val"]=>
  int(5)
}
array(1) {
  ["val"]=>
  int(5)
}

Actual result:
--------------
array(1) {
  ["val"]=>
  &int(5)
}
array(1) {
  ["val"]=>
  &int(5)
}