I know it may exhaust. The only reason why I coded like this is "it was the default". 

IV should be unpredictable, but it's not a secret. I would rather make /dev/urandom a default.  (Windows uses their own API) Since this is for PHP 5.6, it would better to be changed now.