Today i ended up at private properties exposed (Apparently it is also used by PHPUnit)

class foo {
private $bar = 42; }$obj = new foo;
$propname="\0foo\0bar";$a = (array) $obj; echo$a[\$propname];