- var_dump: documentation ( source)
- unserialize: documentation ( source)
<?php
$class = "ArrayObject";
// we break BC here
var_dump(unserialize('O:'.strlen($class).':"'.$class.'":0:{}'));
// we still allow segfault:
class MySplFileObject extends SplFileObject{}
$class = "MySplFileObject";
var_dump(unserialize('O:'.strlen($class).':"'.$class.'":0:{}'));