PHP protected and an assault

class Victim {
$money = 100;

  public function
__toString() {
    return (string)

Offender extends Victim {
assault(Victim $victim) {
$victim->money = 0;

$victim = new Victim;
$offender = new Offender;
print (string)

Courtesy of Damien Tournoud. Actually this is documented:

Objects of the same type will have access to each others private and protected members even though they are not the same instances. This is because the implementation specific details are already known when inside those objects.