I have arrived at a working PoC based on a GitHub repo. But there are signficant caveats. You need 3 precise things to make it work.

1. Initial offsets for functions are PHP version-specific, so you need those going in. That's annoying but easy.
2. Heap layout constants based on Zend MM's memory layout for the PHP build. You get this with GDB precisely on a PHP instance you control, or fuzzing a target—messy.
3. The specific shape of the payload to hit the OOM at the right point. This is largely based on memory limit settings in php.ini.

So there's some prior work to hit a vulnerable target. A PHP offset "rainbow table" may be somewhere or getting built, but those specifics may explain the lag in clear evidence of exploitation.