ResolveControllerNameSubscriber is not checking for the _controller request attribute to be a string. If a callable (or a closure) is set, it will raise the following error:

strpos() expects parameter 1 to be string, array given