PHP serialization format for protected properties

unserialize.php

class Test
{
     protected $foo;
     function __construct($foo) {
          $this->foo = $foo;
     }
}
$str = 'O:4:"Test":1:{s:6:"'."\0".'*'."\0".'foo";s:3:"bar";}';
$obj = unserialize($str);
var_dump($obj);