Validation bypass via stale redirect content type

Improper document parsing in PHP allows remote attackers to bypass validation via a redirected HTTP resource with conflicting charsets. The HTTP stream wrapper retains headers across redirects, and php_libxml_sniff_charset_from_stream scans from the start and uses the first content-type rather than the final response header. Exploitation requires DOM or SimpleXML to fetch an attacker-controlled redirect chain; the stale charset can change document meaning and defeat content validation.