So with this I can XSS myself while in development mode on my development system? That's handy.

There are so many good reasons to turn off display_error during production use, one of which is to not have a broken page due to errors appearing all over the place which even the laziest PHP developer who only cares about "stuff working" would appreciate.

That it also leaks important internal information is another side-effect which generally isn't as appreciated though.

Also the article is showing this code:

    // Undefined function
    error_reporting(E_ALL);
    echo $_GET['funct']();

which they admit is a "rarely used pattern". I would certainly hope so as it is also only marginally better than

    eval($_GET['data']);

or just

    echo "the root password for this machine is: pAsswoRd";