While the default CSV enclosure and delimiter are properly initialised, SplFileObject never explicitly initialises the default escape character within instances after the structure in question is first zeroed with memset(), which means it defaults to (char) 0. All other CSV related functions in PHP default to \ as the escape character as of 5.3.
Fix forthcoming; I'm just opening this so it's searchable and to get a bug number for the NEWS.
Log: Fix bug #53279 (SplFileObject doesn't initialise default CSV escape character).