ze1 question (bug 23132)

I'm trying to track down a ze1 bug for edin: http://bugs.php.net/bug.php?id=23132 What's happening is that under certain conditions (like the testcase in the bug) Variables passed by reference into a function are being reference counted in ZEND_RECV (correct), but not being dereferenced when the function ends and their copy-pointer falls out of scope. In the test case this is done in a loop, which eventually causes the zvals refcount to overflow causing it to be accidentally garbage collected, causing a segfault. I've found and witnessed all of the above, but I'm not sure where the variables should be deref'd when the function ends. Any pointers from anyone in the know?