static void spl_ptr_llist_zval_ctor(spl_ptr_llist_element *elem) { /* {{{ */
	if (Z_REFCOUNTED(elem->data)) {
		Z_ADDREF(elem->data);
	}
}
/* }}} */

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.