Bug report

I am wondering why we don't get an array vs. string error when using the exec by-ref param for $output

Code snippet that reproduces the problem

https://phpstan.org/r/3241126a-47b2-4a0b-bdbc-75d9868b7d97