When a PHP script is requested, PHP reads the script and compiles it into what's called Zend opcode, a binaryrepresentation of the code to be executed.
Binarycode analysis for security has many problems. There is difficult in deducing the representation of bug patterns in binarycode, especially the accurate size of the buffer in stack.