SPL_METHOD(SplDoublyLinkedList, top)
{
	zval *value;
	spl_dllist_object *intern;

	if (zend_parse_parameters_none() == FAILURE) {
		return;
	}

	intern = Z_SPLDLLIST_P(getThis());
	value = spl_ptr_llist_last(intern->llist);

	if (value == NULL || Z_ISUNDEF_P(value)) {
		zend_throw_exception(spl_ce_RuntimeException, "Can't peek at an empty datastructure", 0);
		return;
	}

	ZVAL_DEREF(value);
	ZVAL_COPY(return_value, value);
}

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.