[php-src] Issue #10169: Heap UAF at ZEND_ASSIGN_OBJ_SPEC_CV_CONST_OP_DATA_VAR_HANDLER

Issue: https://github.com/php/php-src/issues/10169 Author: Changochen ### Description The following code: ```php <?php class A { public string $prop = ""; } class B { public function __toString() { global $a; $a = $a->p = ""; return ""; } } $a = new A(); $a->prop = new B(); ?> ``` Resulted in this output: ``` ./php-fuzz-execute poc2.php.orig INFO: Running with entropic power schedule (0xFF, 100). INFO: Seed: 18257342 INFO: Loaded 1 modules (147832 inline 8-bit counters): 147832 [0x1d60c20, 0x1d84d98), INFO: Loaded 1 PC tables (147832 PCs): 147832 [0x1d84d98,0x1fc6518), ./php-fuzz-execute: Running 1 inputs 1 time(s) each. Running: poc2.php.orig ================================================================= ==2886385==ERROR: AddressSanitizer: heap-use-after-free on address 0x6060000121d1 at pc 0x0000012d7b10 bp 0x7fffffffd770 sp 0x7fffffffd768 READ of size 1 at 0x6060000121d1 thread T0 ``` Git commit: https://github.com/php/php-src/commit/ff42cb0c0e8723383135dd33fd9415248a70726b ### PHP Version PHP 8.3.0-dev ### Operating System _No response_