How to leak HHVM 3.5.1-dev

<?php
    header('Content-type: text/plain; ');

    function sad_xml_rawtext_local($buf) {
        $xmlDoc = new DOMDocument('1.0', 'UTF-8');
        echo "\n".__LINE__.' '.(floor(memory_get_usage() / 1024 / 102.4) / 10).'Mb '.
             (floor(memory_get_usage(true) / 1024 / 102.4) / 10).'Mb ';
        $xmlDoc->loadXML($buf);
        echo "\n".__LINE__.' '.(floor(memory_get_usage() / 1024 / 102.4) / 10).'Mb '.
             (floor(memory_get_usage(true) / 1024 / 102.4) / 10).'Mb ';
        $x = $xmlDoc->documentElement;
        echo "\n".__LINE__.' '.(floor(memory_get_usage() / 1024 / 102.4) / 10).'Mb '.
             (floor(memory_get_usage(true) / 1024 / 102.4) / 10).'Mb ';

        return $x;
    }

    function parse_and_parse(&$buf) {
        $xml = @sad_xml_rawtext_local($buf);
        echo "\n".__LINE__.' '.(floor(memory_get_usage() / 1024 / 102.4) / 10).'Mb '.
             (floor(memory_get_usage(true) / 1024 / 102.4) / 10).'Mb ';
        if (gettype($xml) !== 'object') {
            echo "\nnot a object. exit";

            return false;
        }
        unset($xml);
        echo "\n".__LINE__.' '.(floor(memory_get_usage() / 1024 / 102.4) / 10).'Mb '.
             (floor(memory_get_usage(true) / 1024 / 102.4) / 10).'Mb ';

        return true;
    }

    echo "\n".__LINE__.' '.(floor(memory_get_usage() / 1024 / 102.4) / 10).'Mb '.
         (floor(memory_get_usage(true) / 1024 / 102.4) / 10).'Mb ';
    $buf = file_get_contents('http://img.kanaria.ru/storage/mal-nokitakaze.xml');
    echo "\n".__LINE__.' '.(floor(memory_get_usage() / 1024 / 102.4) / 10).'Mb '.
         (floor(memory_get_usage(true) / 1024 / 102.4) / 10).'Mb ';

    for ($i = 0; $i < 10000; $i++) {
        if (!parse_and_parse($buf)) {
            break;
        }
        echo "\n\niteration #{$i} end";
        echo "\n".__LINE__.' '.(floor(memory_get_usage() / 1024 / 102.4) / 10).'Mb '.
             (floor(memory_get_usage(true) / 1024 / 102.4) / 10).'Mb ';
        flush();
    }


    echo "\ndone";
?>