Fixed Bug #67538 (SPL Iterators use-after-free)
Fixed bug #67539 (ArrayIterator use-after-free due to object change during sorting)
update NEWS