AMFPHP treats all ints as uints

Negative ints across the wire are deserialized as unsigned ints. Really big unsigned ints. Not sure how old of a version we are using.

Solvable though.
http://www.visible-form.com/blog/sending-negative-integers-through-amfphp/