Why this DOM-replaceNode function sometimes crashes?

The first function (below) works fine, in a loop over many nodes of the same DOMDocument... But sometimes crashes (no error message but stopping the server).

When we use the second (replace_innerXML_secure), in the same node loop, it never crashes. Why?What is wrong with the first?

• The first use $e->nodeValue='' to delete all childNodes (it its ok?);
• The second preserves one (arbitrary) childNode and use removeChild to delete... A extrange workaround to avoid full deletion when some tag was there.

---

The "equivalent" functions #1 and #2:

// 1. What is wrong with THIS function??
function replace_innerXML(DOMNode $e,$innerXML='') {
    if ($e && ($innerXML>'' || $e->nodeValue>'')) {
        $e->nodeValue='';   
        if ($innerXML>'') {
            $tmp = $this->dom->createDocumentFragment();
            $tmp->appendXML($innerXML);
            $e->appendChild( $tmp );
        }
        return true;
    }
    return false;
}

// 2. Here a workaround... slower but... NOT crashes (!), WHY??
function replace_innerXML_secure(DOMNode $e,$innerXML='') {
    if ($e) {
        $tmp = $e->ownerDocument->createDocumentFragment();
        $tmp->appendXML($innerXML);
        $once=null;         
        foreach(iterator_to_array($e->childNodes) as $e2)
            if (!$once && $e2->nodeType===1) $once=$e2;
            else $e->removeChild($e2);
        if ($once)
            $once->parentNode->replaceChild( $tmp, $once );
        else {
            $e->nodeValue='';
            $e->appendChild( $tmp );
        }
        return true;
    }
    return false;
}

---

NOTES

EDIT2 for @Prix request, some example.

The loop is very complex, but it can be simulated as

   // use this with ANY (and a lot of) BIG HTML files from web... 
   // I have ~1 error/100 samples  
   $dom = new DOMDocument();
   $dom->load($file); // any XML, or loadHTMLfile() 

   $plst = array();  // you can take off the rand()
   foreach ($dom->getElementsByTagName('*') as $node) if (1 || rand(1,3)==1) {
      $plst[] = $node->getNodePath();
   }
   rsort($plst); // from leaves to root
   foreach ($plst as $p) {
      $xp = new DOMXpath($dom); // refresh for each $p
      $node = $xp->query($p);
      if ($node->length && $node=$node->item(0))
          // USING HERE the function#1 or #2:
          replace_innerXML($node,'<new x="1">text</new>');
   }
   $dom->normalizeDocument();

Here some sample XML for $dom, but you can use any $dom->loadHTML($file) to test (!).

  <?xml version="1.0" encoding="utf-8"?>

  <article dtd-version="3.0" article-type="research-article" xml:lang="en">
    <front><journal-meta>
        <journal-title-group><journal-title>text text text</journal-title>
        <abbrev-journal-title abbrev-type="acronym">aaaa</abbrev-journal-title>
        <abbrev-journal-title abbrev-type="publisher">aaabbb aaa</abbrev-journal-title>
        </journal-title-group>
        <etc>....</etc>
        <history><date date-type="received"><label>Received</label> 9 July 2014</date>
            <date date-type="accepted"><label>Accepted</label> 25 July 2014</date>
        </history>
    </journal-meta></front>
    <body>
        <p>Nonnnononn onononono  nonono</p>
        <fn><p><label>XXXXX yyyyy</label>: xxxx@aaa.com</p></fn>

        <p>Nonnnononn onononono  nonono nonono </p>
    </body>
  </article>

EDIT1 for versions and logs

Versions:

• libxml2: 2.8.0+dfsg1-7+wheezy1
• php5: 5.4.4-14+deb7u14
• apache2: 2.2.22-13+deb7u3

Logs: where? I know only /var/log/apache2/error.log, but no error there (only a usual png "File does not exist" that are in a sucess http).

... in this machine, running again today, after http crashes, no big error reported, only "File does not exist: /var/www/favicon.ico" before the crash... But I was running also in a Ubuntu machine, where I find (!) a report about the date and instant of a crash:

 [Wed Oct 15 20:16:16.840578 2014] [core:notice] [pid 1770] AH00051: child pid 14873 exit signal Segmentation fault (11), possible coredump in /etc/apache2
 [Wed Oct 15 20:16:16.840684 2014] [core:notice] [pid 1770] AH00051: child pid 14879 exit signal Segmentation fault (11), possible coredump in /etc/apache2
 *** Error in `/usr/sbin/apache2': corrupted double-linked list: 0x00007f457b81af70 ***
 [Wed Oct 15 20:16:56.886473 2014] [core:notice] [pid 1770] AH00051: child pid 14844 exit signal Aborted (6), possible coredump in /etc/apache2
 [Wed Oct 15 20:16:57.887638 2014] [core:notice] [pid 1770] AH00051: child pid 14894 exit signal Segmentation fault (11), possible coredump in /etc/apache2

yes, a big crash, no clue about why. (I remember that the "standard coredump problem" in LibXML2 is delete or write nodes that not exists).