diff --git a/NEWS b/NEWS
index c382690be39..0a2cec12951 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2012, PHP 5.3.11
 
+- Array:
+  . Fixed bug #52719 (array_walk_recursive crashes if third param of the
+    function is by reference). (Nikita Popov)
+
 - Core:
   . Fixed bug #61165 (Segfault - strip_tags()). (Laruence)
   . Improved max_input_vars directive to check nested variables (Dmitry).
diff --git a/ext/standard/array.c b/ext/standard/array.c
index f18d558bbe4..9956d003430 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1044,7 +1044,7 @@ PHP_FUNCTION(max)
 }
 /* }}} */
 
-static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive TSRMLS_DC) /* {{{ */
+static int php_array_walk(HashTable *target_hash, zval *userdata, int recursive TSRMLS_DC) /* {{{ */
 {
 	zval **args[3],			/* Arguments to userland function */
 		  *retval_ptr,		/* Return value - unused */
@@ -1056,9 +1056,9 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
 
 	/* Set up known arguments */
 	args[1] = &key;
-	args[2] = userdata;
+	args[2] = &userdata;
 	if (userdata) {
-		Z_ADDREF_PP(userdata);
+		Z_ADDREF_P(userdata);
 	}
 
 	zend_hash_internal_pointer_reset_ex(target_hash, &pos);
@@ -1080,7 +1080,7 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
 			if (thash->nApplyCount > 1) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
 				if (userdata) {
-					zval_ptr_dtor(userdata);
+					zval_ptr_dtor(&userdata);
 				}
 				return 0;
 			}
@@ -1133,7 +1133,7 @@ static int php_array_walk(HashTable *target_hash, zval **userdata, int recursive
 	}
 
 	if (userdata) {
-		zval_ptr_dtor(userdata);
+		zval_ptr_dtor(&userdata);
 	}
 	return 0;
 }
@@ -1157,7 +1157,7 @@ PHP_FUNCTION(array_walk)
 		return;
 	}
 
-	php_array_walk(array, userdata ? &userdata : NULL, 0 TSRMLS_CC);
+	php_array_walk(array, userdata, 0 TSRMLS_CC);
 	BG(array_walk_fci) = orig_array_walk_fci;
 	BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
 	RETURN_TRUE;
@@ -1182,7 +1182,7 @@ PHP_FUNCTION(array_walk_recursive)
 		return;
 	}
 
-	php_array_walk(array, userdata ? &userdata : NULL, 1 TSRMLS_CC);
+	php_array_walk(array, userdata, 1 TSRMLS_CC);
 	BG(array_walk_fci) = orig_array_walk_fci;
 	BG(array_walk_fci_cache) = orig_array_walk_fci_cache;
 	RETURN_TRUE;
diff --git a/ext/standard/tests/array/bug52719.phpt b/ext/standard/tests/array/bug52719.phpt
new file mode 100644
index 00000000000..078c53d2257
--- /dev/null
+++ b/ext/standard/tests/array/bug52719.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #52719: array_walk_recursive crashes if third param of the function is by reference
+--FILE--
+<?php
+$array = array("hello", array("world"));
+$userdata = array();
+array_walk_recursive(
+    $array,
+    function ($value, $key, &$userdata) { },
+    $userdata
+);
+echo "Done";
+?>
+--EXPECTF--
+Done