I suppose they could have made it work differently just for nested functions, but that's a major inconsistency, it's not clear how it would interact with globals, etc.
register globals imported request parameters from the query string and post body into the global variable scope.
having undeclared variables "act like empty strings" is related to non-strict variable comparison (== vs ===) and either silencing errors, or not displaying/caring about them.
of course it could be a security issue without undefined variables coercing to an empty string in string context - it could allow request parameters to override defined variables.