The array_fill function in ext/standard/array.c in PHP 4.4.2 and 5.1.2 allows context-dependent attackers to cause a denial of service (memory consumption) via a large num value.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2006-7184
http://www.infigo.hr/hr/in_focus/advisories/INFIGO-2006-04-02