Segfault when passing anonymous function to PHP function

[stesie]

If I pass an anonymous function from JS back to PHP as a function argument like

$js = new JSContext();
function foo($cb) { global $a; $a = $cb; }
$js->registerFunction('foo');
$js->evaluateScript('foo(function() { });');

... then the extension crashes in _jsval_to_zval:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff4c4ae2d in _jsval_to_zval (return_value=0x7ffff7fdfab0, ctx=ctx@entry=0x114a350, rval=..., parent=parent@entry=0x0)
    at /usr/local/src/php-spidermonkey/spidermonkey.cc:418
418             if ((jsref = (php_jsobject_ref*)JS_GetPrivate(obj)) == NULL || jsref->obj == NULL)
(gdb) bt
#0  0x00007ffff4c4ae2d in _jsval_to_zval (return_value=0x7ffff7fdfab0, ctx=ctx@entry=0x114a350, rval=..., parent=parent@entry=0x0)
    at /usr/local/src/php-spidermonkey/spidermonkey.cc:418
#1  0x00007ffff4c4c259 in generic_call (cx=0x114a350, argc=1, vp=0x118a568)
    at /usr/local/src/php-spidermonkey/spidermonkey_external.cc:113
#2  0x00007ffff455e054 in ?? () from /usr/lib/x86_64-linux-gnu/libmozjs-24.so.0
#3  0x00007ffff4561ff9 in ?? () from /usr/lib/x86_64-linux-gnu/libmozjs-24.so.0
#4  0x00007ffff456b968 in ?? () from /usr/lib/x86_64-linux-gnu/libmozjs-24.so.0
#5  0x00007ffff456bb81 in ?? () from /usr/lib/x86_64-linux-gnu/libmozjs-24.so.0
#6  0x00007ffff46141ba in JS::Evaluate(JSContext*, JS::Handle<JSObject*>, JS::CompileOptions, unsigned short const*, unsigned long, JS::Value*) () from /usr/lib/x86_64-linux-gnu/libmozjs-24.so.0
#7  0x00007ffff461430e in JS::Evaluate(JSContext*, JS::Handle<JSObject*>, JS::CompileOptions, char const*, unsigned long, JS::Value*)
    () from /usr/lib/x86_64-linux-gnu/libmozjs-24.so.0
#8  0x00007ffff461459a in JS_EvaluateScript(JSContext*, JSObject*, char const*, unsigned int, char const*, unsigned int, JS::Value*)
    () from /usr/lib/x86_64-linux-gnu/libmozjs-24.so.0
#9  0x00007ffff4c4bdb4 in zim_JSContext_evaluateScript (ht=<optimized out>, return_value=0x7ffff7fe2560, 
    return_value_ptr=<optimized out>, this_ptr=<optimized out>, return_value_used=<optimized out>)
    at /usr/local/src/php-spidermonkey/spidermonkey_context.cc:166
#10 0x00000000006dd9cb in dtrace_execute_internal ()
#11 0x000000000079da25 in ?? ()
#12 0x0000000000717758 in execute_ex ()
#13 0x00000000006dd8c9 in dtrace_execute_ex ()
#14 0x00000000006e175a in zend_eval_stringl ()
#15 0x00007ffff52adb57 in ?? () from /usr/lib/php5/20121212/readline.so
#16 0x000000000079f751 in ?? ()
#17 0x0000000000461de0 in main ()

Tested with spidermonkey library shipped with Ubuntu Trusty, version 24.2.0-1