Using POST data to call a function from a specified class
Well, I'm going to post it as an answer, simply because comments aren't the right place for this:


  See edit for justification


You can't justify using $_POST data to call functions or methods in a script. never trust the network, POST data is coming from the network, never trust it. Full stop.
It's a piece of cake to send something like __toString, __invoke, __sleep and other magic-methods. They might exist, so they might pass the method_exist check you do. However, what they do is something different entirely.

You're basically calling a method on an object. That implies a finite list of methods that exist and are callable (there's a function called is_callable to chekc just that, BTW).
A safer way might be to have a property (array) containing a white-list of methods that can be invoked through JS requests:

$psMethods = array(
    'ajaxMethod1',
    'ajaxMethod2'
);


As an added bonus, you could use the method names as keys, and assign those keys a couple of arguments that the method might require.
The downside of this (a static array) is that you'll have to add and remove items from this array as you write your code. Don't worry however, help is at hand thanks to get_class_methods:

private $SP = null;
private $spMethods = array();//empty
//in constructor, or wherever you assign $this-&gt;SP
public function __construct(SPClass $sp)
{
    $this-&gt;SP = $sp;
    $methods = get_class_methods($sp);
    foreach($methods as $method)
    {
        if (substr($method, 0, 5) === 'ajax_')
        {
            $this-&gt;spMethods[] = substr($method,5);
        }
    }
}


Here, any method that has to be callable through an ajax request has to be given an arbitrary prefix (ajax_ in this case). That's how you can determine what methods are valid.
Then, when you receive your data:

if (in_array($_POST['function'], $this-&gt;spMethods)) //valid post data
    return $this-&gt;SP-&gt;{'ajax_'.$_POST['function']}();
else


What to do in the else cases? the choice is yours, really: either provide a default, fallback method in $this-&gt;SP:

public function ajax_fallback(array $post = null)
{
    return array('invalid/unknown request action', $post);
}


throw an exception or return a valid json encoded string (json_encode should be passed at least an array, strings needn't be encoded)

Resist the temptation to guess what $_POST['function'] should've been. If its contents is invalid, that can only mean one of the following things:


there's an error in either your PHP or JS code, in which case: fix it
clients trying to exploit your ajax call, in which case, don't try to help them by guessing, throw an exception. Amateur hackers aren't worth the code that'll only end up making it easier for them to actually achieve something
connection problems (unlikely), trying to work your way around those is pointless, so don't


Other considerations:
If you are going to post (part of) a function name to your server, don't call that parameter function. Everybody knows what a function is, so it doesn't take long for some spotty teen to realize which post param is worth trying to exploit!
Sending data over ajax isn't secure anyway, I'd not send a function name, but given the info you've provided, I can't tell which is the better way to go. It might be worth while to hash the function names, and compare the hash value to an array of hashes. The chances someone guesses a hash of (part of) a function name, especially when you add salt are very low indeed:

    $this-&gt;SP = $sp;
    $methods = get_class_methods($sp);
    foreach($methods as $method)
    {
        if (substr($method, 0, 5) === 'ajax_')
        {
            $this-&gt;spMethods[] = sha1(
                'YOUR_sup3rh3r03-0F=çH01ce'.substr($method,5);
            );
        }
    }


and just hard-code, or send these hashes over through a predefined ajax request.
Those teen-would-be-hackers are easily discouraged when they realize they have to use strings like "ff45204b9bbf938f7c10a734ed4e05434203790d", without knowing what they are :-)