Two faults here:

 * In the else case the code just continues without incrementing i, type_spec or fetching the respective va_arg(s)
 * In the if case arg is set to a stack value which is a pointer to yet another stack value and both of those are in the if branch, so they won't exist after it is left.

Another consideration: Can it happen that the NULL zval create here will be modified in the arg_impl to some other type (that requires freeing?)