Fixed bug #67539 (ArrayIterator use-after-free due to object change during sorting)

Conflicts:
	ext/spl/spl_array.c