Bug report

When using the call_user_func() function, no detection of the passed type is performed as when the function is called directly.

Code snippet that reproduces the problem

https://phpstan.org/r/aefe7560-a80c-4207-a976-9ed696705b9b

// error
echo vsprintf('aa %s bb', call_user_func(function (): array { return ['a']; }));

// but ok
echo vsprintf('aa %s bb', (function (): array { return ['a']; })());

Expected output

Same input as in case of native callback.