5.3.9's implementation of max_input_vars has a serious bug that can lead to remote code execution: http://thexploit.com/sec/critical-php-remote-vulnerability-introduced-in-fix-for-php-hashtable-collision-dos/ PHP 5.3.10 has already been released, notes "Fixed arbitrary remote code execution vulnerability reported by Stefan Esser, CVE-2012-0830." Surprised there doesn't seem to already be an open issue for this. Reproducible: Always
*** This bug has been marked as a duplicate of bug 401997 ***
Also, read the instructions on the file bug page next time thoroughly.