<?php
ini_set('arg_separator.output', "f\0oo");
$r = new ReflectionExtension('core');
$str = (string)$r;
$index = strpos($str, 'Entry [ arg_separator.output');
$str = substr($str, $index);
$index = strpos($str, 'Entry', 1);
$str = substr($str, 0, $index);
echo $str . "\n";
var_dump( $r->getINIEntries()['arg_separator.output'] );
After #22658 I figured I would check some other things, the following all truncate on null bytes in user-controlled values
ReflectionClass::__toString() from doc comment
ReflectionConstant::__toString() from constant name
ReflectionClassConstant::__toString() from doc comment
ReflectionEnum::__toString() with enum case documentation
ReflectionEnum::__toString() with backed enum value
ReflectionProperty::__toString() with doc comment
ReflectionProperty::__toString() with dynamic property name
ReflectionExtension::__toString() with INI option value (also there is a weird `}` without a `{`, that should probably be fixed on master)
ReflectionFunctionAbstract::__toString() with doc comment