A friend of mine recently discovered and sent me a small collection of trojan php scripts that were uploaded to his machine. Here's an example:
Why do attackers bother doing all of this? Any developer can trivially reverse these steps to see the source code.
The only reason I can imagine is an attempt to prevent antivirus detection against an existing codebase (base64() the script, you have a 'new' virus, at least for a few minutes).
This vector is largely successfully mitigated by things like heuristic virus detection, which looks precisely for suspicious snippets of source like this.