• CLI webserver - didn't find any mention in the docs

• XsltProcessor::setSecurityPrefs($options) and getSecurityPrefs() - Chergu, Nicolas Gregoire
• RegexIterator::getRegex - Joshua Thijssen
• ReflectionExtension::isTemporary & isPersistent, ReflectionClass::isCloneable, class ReflectionZendExtension, - Johannes

• OpenSSL functions:

openssl_csr_get_public_key, openssl_csr_get_subject, openssl_decrypt, openssl_dh_compute_key, openssl_digest, openssl_encrypt - shown in the manual as undocumented, additionally for encrypt and decrypt signatures do not match actual state of affairs in 5.4 - options is long, but bool parameter is listed instead.

• mysql_list_dbs - not documented as deprecated in 5.4 - Andrey
• mysqli_result - not documented as implementing Traversable - Andrey, Johannes
• ldap_control_paged_result, ldap_control_paged_result_response - pajoye, scottmac
• ldap_parse_reference and ldap_parse_result undocumented too, btw
• JSON_BIGINT_AS_STRING constant undocumented - Sara
• JsonSerializable interface - listed in manual as undocumented - Sara
• Spoofchecker class - constants and methods are not documented - Scott
• hex2bin - Scott
• import_request_variables, define_syslog_variables, session_is_registered, session_register, session_unregister - not documented as removed in 5.4
• Ini options allow_call_time_pass_reference, define_syslog_variables, highlight.bg - not documented as removed in 5.4
• Magic quotes removal in 5.4 not documented - Pierrick, Pierre
• Short array notation - Pierre
• windows_show_crt_warnings INI directive - Pierre
• SORT_NATURAL and SORT_FLAG_CASE options for sort functions - Arpad
• disable_post_data_processing - Gustavo
• callable type in function args - Hannes
• SessionHandler class - Arpad
• Closure::bind and Closure::bindTo - Gustavo

but in fact whole Closure class is badly documented