<?php
class A {
 public $_;
 public function __get($name) {
 global $obj;
 $obj->f =& $this->b - $x > $y = new StdClass;
 static $a = $a;
 $t = 'x';
 foreach (get_defined_vars() as $key => $e) {}
 if ($v ==!1) $x = $a ?: $t = "ok";
 }
}
$rc = new ReflectionClass(A::class);
$obj = $rc->newLazyProxy(function () { return new A; });
$real = $rc->initializeLazyObject($obj);
var_dump($real->prop);

php: /path/to/php-src/Zend/zend_execute.c:256: _get_zval_ptr_tmp: Assertion `zval_get_type(&(*(ret))) != 10' failed.
Aborted

./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib

PHP 8.6.0-dev (cli) (built: Jan 9 2026 14:43:36) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
 with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies