Description:
------------
I use a fresh php just compiled for test like this 

./sapi/cli/php ~/public_html/test.php

It occurred to me that Bug #72286, is indeed an use after free kind of bug so could be exploitable.

With a variation of Bug #72286 report, I show how the bug could lead to not intended execution.

For the proof of concept I just call a method which echo "dangerous". If I don't mistake attribute change could be also obtained.

Apart that the destructed  object should be take in a reference cycle, and the garbage collection triggered, the only constraint I see of the proof of concept is that a target object must be created inside the destructor and the  target method/attribute should be call

Test script:
---------------
https://gist.github.com/xcombelle/cc8c391e93d01dfe9568bf634a656767

Expected result:
----------------
not dangerous

Actual result:
--------------
dangerous