HashTable use-after-destroy in function table via stream wrapper magic __call() with nested redeclaration

Description

The following code:

<?php
class Loader {
    function stream_open() {
        return true;
    }
    function __call($m, $a) {
        $map[$obj] = putenv("LA=Gx$g_lang");
        function __call($m, $a) {}
    }
}
stream_wrapper_register('abc', 'Loader');
require 'abc://';

Resulted in this output:

/path/to/php-src/Zend/zend_hash.c(1555) : ht=0x5589df607568 is already destroyed
php: /path/to/php-src/Zend/zend_hash.c:73: _zend_is_inconsistent: Assertion `0' failed.
Aborted

Commit:

824c3891281bb4deb5a1aa245313a6c6b0ea786f

Build configuration:

CC="clang" CXX="clang++" CFLAGS="-fsanitize=address -g -O0" CXXFLAGS="-fsanitize=address -g -O0" LDFLAGS="-fsanitize=address" ./buildconf --force && ./configure --enable-debug --enable-address-sanitizer --disable-shared --with-pic --enable-mbstring --with-zlib

PHP Version

PHP 8.6.0-dev (cli) (built: Dec  6 2025 16:29:29) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.6.0-dev, Copyright (c) Zend Technologies
    with Zend OPcache v8.6.0-dev, Copyright (c), by Zend Technologies

Operating System

Ubuntu 22.04

使用 issue 中的 PHP 代码片段和 debug build configuration 重现该失败，然后先阅读 zend_hash.c 中报告的 assertion 附近部分。跟踪 stream wrapper 的 __call() 以及嵌套函数重新声明的路径；完成的标准是该示例不再报告 destroyed hash table，也不再 abort。