Fixed bug #67072 Echoing unserialized "SplFileObject" crash

The actual issue lays in the unserializer code which doesn't honor
the unserialize callback. By contrast, the serialize callback is
respected. This leads to the situation that even if a class has
disabled the serialization explicitly, user could still construct
a vulnerable string which would result bad things when trying
to unserialize.

This conserns also the classes implementing Serializable as well
as some core classes disabling serialize/unserialize callbacks
explicitly (PDO, SimpleXML, SplFileInfo and co). As of now, the
flow is first to call the unserialize callback (if available),
then call __wakeup. If the unserialize callback returns with no
success, no object is instantiated. This makes the scheme used
by internal classes effective, to disable unserialize just assign
zend_class_unserialize_deny as callback.
Merge branch 'PHP-5.4' into PHP-5.5

* PHP-5.4:
  Fixed bug #67072 Echoing unserialized "SplFileObject" crash

Conflicts:
	ext/standard/var_unserializer.c
updated NEWS
Merge branch 'PHP-5.5' into PHP-5.6

* PHP-5.5:
  updated NEWS
  Fixed bug #67072 Echoing unserialized "SplFileObject" crash
updated NEWS
Merge branch 'PHP-5.6'

* PHP-5.6:
  updated NEWS
  updated NEWS
  Fixed bug #67072 Echoing unserialized "SplFileObject" crash
These links to ~helly don't work anymore.
These links to ~helly don't work anymore.
Merge branch 'PHP-5.4' into PHP-5.5
Merge branch 'PHP-5.5' into PHP-5.6
Merge branch 'PHP-5.6'
Fixed test case for 5328d42
Fixed test case for 5328d42
Merge branch 'PHP-5.5' into PHP-5.6

* PHP-5.5:
  Fixed test case for 5328d42
Merge branch 'PHP-5.6'

* PHP-5.6:
  Fixed test case for 5328d42
Merge branch 'pull-request/646'

* pull-request/646:
  Fixed test case for 5328d42
Improved the fix for bug #67072, thanks Nikita
Merge branch 'PHP-5.4' into PHP-5.5

* PHP-5.4:
  Improved the fix for bug #67072, thanks Nikita
refixed the test related to bug #67072
Merge branch 'PHP-5.5' into PHP-5.6

* PHP-5.5:
  refixed the test related to bug #67072
  Improved the fix for bug #67072, thanks Nikita