diff --git a/NEWS b/NEWS
index 64e926ff239..ffb12f19871 100644
--- a/NEWS
+++ b/NEWS
@@ -11,6 +11,8 @@ PHP                                                                        NEWS
     prototype). (Bob)
   . Fixed bug GH-18581 (Coerce numeric string keys from iterators when argument
     unpacking). (ilutov)
+  . Fixed OSS-Fuzz #434346548 (Failed assertion with throwing __toString in
+    binary const expr). (ilutov)
 
 - FTP:
   . Fix theoretical issues with hrtime() not being available. (nielsdos)
diff --git a/Zend/tests/oss_fuzz_434346548.phpt b/Zend/tests/oss_fuzz_434346548.phpt
new file mode 100644
index 00000000000..139e36758bc
--- /dev/null
+++ b/Zend/tests/oss_fuzz_434346548.phpt
@@ -0,0 +1,22 @@
+--TEST--
+OSS-Fuzz #434346548: Failed assertion with throwing __toString in binary const expr
+--FILE--
+<?php
+
+class Foo {
+    function __toString() {}
+}
+
+function test($y = new Foo() < "") {
+    var_dump();
+}
+
+try {
+    test();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Foo::__toString(): Return value must be of type string, none returned
diff --git a/Zend/zend_ast.c b/Zend/zend_ast.c
index f3f03940c62..9df2320d566 100644
--- a/Zend/zend_ast.c
+++ b/Zend/zend_ast.c
@@ -585,9 +585,10 @@ ZEND_API zend_result ZEND_FASTCALL zend_ast_evaluate_inner(
 				ret = FAILURE;
 			} else {
 				binary_op_type op = get_binary_op(ast->attr);
-				ret = op(result, &op1, &op2);
+				op(result, &op1, &op2);
 				zval_ptr_dtor_nogc(&op1);
 				zval_ptr_dtor_nogc(&op2);
+				ret = EG(exception) ? FAILURE : SUCCESS;
 			}
 			break;
 		case ZEND_AST_GREATER: