Description of problem:

file_exists() silently truncates anything after a null byte in a string.  This produces unexpected results in some circumstances and possibly would result in security problems for limited amounts of poorly written code.

include_once() for instance, provides the following:
"ALERT - Include filename truncated by a \0 after '/etc/passwd' (attacker 'REMOTE_ADDR not set', file '/home/djc/test.php', line 13)"

This seems like a sane way to handle it if truncating has to be done... though frankly since truncation will *always* produce the wrong result it might be nice to throw an error and stop processing.

Check https://bugs.php.net/bug.php?id=39863

Run script

https://bugs.php.net/patch-display.php?bug_id=39863&patch=bug39863.phpt&revision=latest

MUST be show PASS, but script return FAIL.