Fix $arr =& $arr[0]

value_ptr can be invalidated by the ptr_dtor, so backup the
zend_reference in an extra variable.
Fix dynamic calls to static methods with fci->object

func may already be freed at the time the static flag was checked.