fix segfault when assigning value by ref and add test

(I consider it's wrong that we can't do it, but we shouldn't segfault anyway)

ext/spl/spl_array.c

@@ -219,6 +219,10 @@ static zval **spl_array_get_dimension_ptr_ptr(int check_inherited, zval *object,
 	if (check_inherited && intern->fptr_offset_get) {
 		return zend_call_method_with_1_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_get, "offsetGet", NULL, offset);
 	}*/
+
+	if (!offset) {
+		return &EG(uninitialized_zval_ptr);
+	}
 	
 	switch(Z_TYPE_P(offset)) {
 	case IS_STRING:

ext/spl/tests/iterator_035.phpt

@@ -0,0 +1,17 @@
+--TEST--
+SPL: ArrayIterator and values assigned by reference
+--SKIPIF--
+<?php if (!extension_loaded("spl")) print "skip"; ?>
+--FILE--
+<?php
+	
+$tmp = 1;
+
+$a = new ArrayIterator();
+$a[] = $tmp;
+$a[] = &$tmp;
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Fatal error: Objects used as arrays in post/pre increment/decrement must return values by reference in %s on line %d