This option will be supported in HHVM 3.23+; it requires that callsites specify '&' when passing an argument by ref; for example:

$foo = vec[1,3,2];
sort(&$foo);

.hhconfig:

enable_experimental_tc_features=safe_pass_by_ref

With the option off, in 3.23+, the '&' is ignored - but it is an error in master. This can be worked on now if you build HHVM master, or brew tap hhvm/hhvm; brew install hhvm-preview if working on a mac.

This requires building support for migrations that query and fix typechecker errors, rather than purely operating on the AST