static zend_object *spl_dllist_object_new(zend_class_entry *class_type) /* {{{ */
{
	return spl_dllist_object_new_ex(class_type, NULL, 0);
}
/* }}} */

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.