I'll accept this argument when PHP starts shipping with sane defaults. It's only quite recently that register globals got turned off in the default config.
http://php.net/manual/en/security.globals.php
5.3.0 is 2 and a half years old.
"Now just marginally less braindead than every other language" isn't exactly a selling point.
Sure, it used to be worse, but I see zero commitment from PHP to actually make real steps to fixing the situation. A real first step would be to start working on a 6.x release that actually removes the gazillion deprecated-but-still-present-and-thus-used things in the language.