Minor fixes:

missing zval_copy_ctor()
	messed up AiCount fix

Zend/zend_compile.c

@@ -1438,6 +1438,7 @@ void do_list_end(znode *result, znode *expr CLS_DC)
 	le = CG(list_llist).head;
 	while (le) {
 		do_assign(result, &((list_llist_element *) le->data)->var, &((list_llist_element *) le->data)->value CLS_CC);
+		EG(active_op_array)->opcodes[EG(active_op_array)->last-1].result.u.EA.type |= EXT_TYPE_UNUSED;
 		le = le->next;
 	}
 	zend_llist_destroy(&CG(dimension_llist));

Zend/zend_execute.c

@@ -1453,6 +1453,7 @@ send_by_ref:
 							**varptr_ptr = *varptr;
 							varptr = *varptr_ptr;
 							varptr->refcount = 1;
+							zval_copy_ctor(varptr);
 						}
 						varptr->is_ref = 1;
 						/* at the end of this code refcount is always 1 */