The problem is:

if (has_value) {
    ZVAL_UNDEF(&current);
    if (php_var_unserialize(&current, (const unsigned char **) &p, (const unsigned char *) endptr, &var_hash)) {
        zval *zv = php_set_session_var(name, &current, &var_hash );
        var_replace(&var_hash, &current, zv);

php_set_session_var may cause http_session_vars resize, which will make the var in var_hash->data become invalid..

I propose to fix this by prepend a magic var "__SESS_N_VARS" to session serialized string, with this, we could know how many vars there before doing session decoding, and extend PS(http_session_vars) to the proper size, thus can avoding hash table resize, as this is a little tricky , so I make PR instead of pushing it directly.

thanks