It's important to note here that
phar_fix_filepath is not a PHP function that your web app uses. It's a function in the C source of the PHP engine. You security issue that the pentester is referencing is probably CVE-2015-5590:
Stack-based buffer overflow in the
phar_fix_filepath function in
ext/phar/phar.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value, as demonstrated by mishandling of an e-mail attachment by the imap PHP extension.
So what has the pentester done here? She has probably checked what version of PHP you are using (by default this is conveniently displayed in a HTTP response header, but it can also be found through fingerprinting). Then she just needs to check any list of known vulnerabilities to see which ones affect that version.
But does the pentester know that your code results in this function being executed and that the vulnerability can be exploited? Probably not. My guess is that she is satsified with pointing out that the PHP version is vulnerable, no matter if your app is affected or not. And honestly, that is bad enough. Even if this can't be exploited at the moment, the slightest change in the source code might change that fact. You need to upgrade your PHP engine no matter what.
With that view, you don't need access to the source code, since the analysis is based only on the version number. If one were to determine if your app can actually be exploited, access to the source code would help a lot, though.