fix read_property handler (return_value lives on stack of zend_read_property)