Its not just strings, all kinds of data structures are vulnerable. See: <a href="http://www.hardened-php.net/hphp/zend_hash_del_key_or_index_vulnerability.html" rel="nofollow">http://www.hardened-php.net/hphp/zend_hash_del_key_or_index_...</a>