Hit this one at work, where we use RHEL4’s PHP 4.3.9.
The online documentation doesn’t mention it any more, but there’s a history of PHP not dealing well with array references.
PHP segfaults. Unfortunately it’s quite hard to reproduce artificially; we don’t see the segfault until way after the reference was taken (presumably after the GC has done its rounds). It’s 100% reproducible in our program, but I’m still working on a minimal test case.