Description:
------------
Code modifying the result of __get (erroneously) and using undefined variables crashes, apparently because of unitialized_zval being freed. 

Reproduce code:
---------------
<?php
class Foo {
	function __get($k) {
		return null;
	}
	function __set($k, $v) {
		$this->$k = $v;
	}
}

$c = new Foo();

$c->arr[0]["k"] = 1;
$c->arr[0]["k2"] = $ref;
for($cnt=0;$cnt<6;$cnt++) {
	$ref = chop($undef);	
	$c->arr[$cnt]["k2"] = $ref;
}
?>

Expected result:
----------------
No crash :)

Actual result:
--------------
On windows - crash
On Unix debug - 
php5/Zend/zend_hash.c(517) : ht=0xa533520 is being destroyed