As first mentioned in PHPC-209:

When php_phongo_bson_visit_document() and php_phongo_bson_visit_array() iterate on the keys within objects and arrays, respectively, the class name picked up by php_phongo_bson_visit_binary() is used for hydration and the unserialize method (i.e. BSON_UNSERIALIZE_FUNC_NAME) is invoked directly. From what I can tell, this code doesn't appear to check if the class itself implements the required interface.