True. 
And funny ... just today i was also thinking of a potential collision there :-)

The reason why i choose using an one way hash function for the code_hash was that i did'nt want, for security reasons, saving the $keys, in cleartext, in the internal $lambda_functions array, where it stays permanent, even if the user unset()'ing his Crypt object.

But the collision point is absolut valid.
What do you think about ```$code_hash = md5(...) . sha1(...)```  ?
That would, i think, very much reduce the still very rare collision probability. And they are build-in since php4.

Or maybe there is an other better, at best 100% collision-free, way to (fast) one-way-hash'ing the $code_hash?

On the other side... would'nt it be very interesting about a bug report anytime (if ever happens), reporting a md5() collision there? :-) 

What do you think Patrick?