Vulnerability I am referring to is:
And here in more detail:
So basically what it amounts to is that in the code someone forgot to add an "else" statement and it allows an attacker-controlled string to be interpreted as a ZVAL struct. What I want to know is if an attacker could potentially store something else other than a hardcoded address in the string he/she controlls such as a pointer or register. I'm pretty sure this isn't possible, but if it was it would make code execution much easier.