diff --git a/NEWS b/NEWS
index 45610bb0ccf..8037fb7354f 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ PHP                                                                        NEWS
   . Fix various missing NULL checks. (nielsdos, dstogov)
   . Fixed bug GH-12835 (Leak of call->extra_named_params on internal __call).
     (ilutov)
+  . Fixed bug GH-12826 (Weird pointers issue in nested loops). (nielsdos)
 
 - FPM:
   . Fixed bug GH-12705 (Segmentation fault in fpm_status_export_to_zval).
diff --git a/Zend/tests/gh12826.phpt b/Zend/tests/gh12826.phpt
new file mode 100644
index 00000000000..adfc3a747c3
--- /dev/null
+++ b/Zend/tests/gh12826.phpt
@@ -0,0 +1,30 @@
+--TEST--
+GH-12826 (Weird pointers issue in nested loops)
+--FILE--
+<?php
+$test = array(
+  'a' => 1,
+  'b' => 2,
+  'c' => 3,
+  'd' => 4,
+);
+
+unset($test['a']);
+unset($test['b']);
+
+foreach($test as $k => &$v) { // Mind the reference!
+    echo "Pass $k : ";
+
+    foreach($test as $kk => $vv) {
+        echo $test[$kk];
+        if ($kk == $k) $test[$kk] = 0;
+    }
+
+    echo "\n";
+}
+
+unset($v);
+?>
+--EXPECT--
+Pass c : 34
+Pass d : 04
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 03683e3a1ea..6668c4c17c6 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -2407,7 +2407,7 @@ static zend_always_inline uint32_t zend_array_dup_elements(HashTable *source, Ha
 					idx++; p++;
 				}
 			} else {
-				target->nNumUsed = source->nNumOfElements;
+				target->nNumUsed = source->nNumUsed;
 				uint32_t iter_pos = zend_hash_iterators_lower_pos(target, idx);
 
 				while (p != end) {