[php-src] Issue #20875: Assertion failure in _get_zval_ptr_tmp with lazy proxy

Issue: https://github.com/php/php-src/issues/20875
Author: vi3tL0u1s

### Description

The following code:

```php
<?php
class A {
    public $_;
    public function __get($name) {
        global $obj;
        $obj->f =& $this->b - $x > $y = new StdClass;
        static $a = $a;
        $t = 'x';
        foreach (get_defined_vars() as $key => $e) {}
        if ($v ==!1) $x = $a ?: $t = "ok";
    }
}
$rc = new ReflectionClass(A::class);
$obj = $rc->newLazyProxy(function () { return new A; });
$real = $rc->initializeLazyObject($obj);
var_dump($real->prop);
```

Resulted in this output:
```
php: /path/to/php-src/Zend/zend_execute.c:256: _get_zval_ptr_tmp: Assertion `zval_get_type(&(*(ret))) != 10' failed.
Aborted
```

## Commit

`eea9a62b1bb3e429e58259408e1beb6ca3f22305`

## Configurations

```
./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib
```


### PHP Version

```plain
PHP 8.6.0-dev (cli) (built: Jan  9 2026 14:43:36) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies
```

### Operating System

Ubuntu 22.04