An example is the first test failure in https://integration.wikimedia.org/ci/job/mediawiki-extensions-hhvm/58222/consoleFull: $wgAuth->getUserInstance( $this ) is called somewhere in User, $wgAuth gets unstubbed, StubObject::_call calls call_user_func_array( [ <real AuthPlugin object>, 'getUserInstance' ], $user ) which explodes because the signature of that method is getUserInstance( User &$user ) and a plain object is passed.
The fix in T78427: Pass-by-reference arguments not passed by reference through StubObject::_call() was a one off correction for Language::findVariantLink(). This looks to be another instance of the same underlying problem, namely that __call() magic doesn't support detecting pass-by-reference on the unstubbed object. There is no general solution to this class of problems. Either the stubbed object's method needs to change to not expect pass-by-reference input or an explicit method must be added to StubObject that preserves the expected method signature.
Well, the general solution is to use reflection to detect which arguments need to be references. But I imagine for something as performance-sensitive as unstubbing that would be a bad idea.
I doubt reflection would necessarily work right, anyway: the $args array passed to __call() probably doesn't have references in the first place, so even if we change things in there to references they won't be referencing what they should be referencing in the caller's scope.