See D8914 and IRC. The root issue was that this code:

foreach ($some_object as $thing) {
  // ...
}

...means "iterate over the public properties of the object" in PHP, and does not raise any warnings or throw an exception.

This has very nearly bitten me several times too; we never want to do this. Instead, throw from objects extending Phobject.

• Added and ran unit tests.
• Tried to foreach() an arbitrary object.