Property handle read_property exception in fetch_property_address

Otherwise we leak (and corrupt uninitialized_zval).

Zend/tests/exception_during_by_reference_magic_get.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Exception thrown by __get() during =& assignment
+--FILE--
+<?php
+
+class Test {
+    private $x;
+    public function &__get($name) {
+        throw new Exception("Foobar");
+    }
+}
+
+$test = new Test;
+$y = 5;
+try {
+    $test->x =& $y;
+} catch (Exception $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Foobar

Zend/zend_execute.c

@@ -2872,6 +2872,10 @@ static zend_always_inline void zend_fetch_property_address(zval *result, zval *c
 			}
 			return;
 		}
+		if (UNEXPECTED(EG(exception))) {
+			ZVAL_ERROR(result);
+			return;
+		}
 	} else if (UNEXPECTED(Z_ISERROR_P(ptr))) {
 		ZVAL_ERROR(result);
 		return;