> If that's really the case, it seems like Rasmus has eliminated a large swath of null byte vulnerabilities in PHP applications.

Yes -- this specific change mitigates a lot of simple local file inclusion vulnerabilities. It's not a cure-all, but it does at least prevent many common antipatterns (e.g, include("languages/$_COOKIE['lang'].php")) from being trivially exploited.