Firewall – Multiple blades in one chassis, some in DMZ, some in internal network

To allow connections from the DMZ to the internal LAN is breaking with the concept of a DMZ.

Binding MySQL to localhost is going to be no less secure than placing MySQL elsewhere. If data theft is your concern, you should assume that were the two machines split apart and the Apache portion was compromised, then MySQL connection details stored on the compromised machine could simply be re-utilised by an attacker to read the data out anyway.

Edit to add:

Even with a double-hop DMZ as you describe, you're not purchasing yourself any real security benefit from separating the services, whilst at the same time making the setup more complicated. You're possibly even increasing the attack surface by having more machines and sending data over the wire that would otherwise be on loopback.

Setup the switches to run "DMZ" network traffic over a vLan, and be very careful where that vLan traffic is allowed to go.

One of my sites has 1 switch, the internet traffic is plugged directly into switch port 24 (with a big sticker explaining what port 24 is stuck to the switch). The switch is configured so port 24 is vLan 20 (untagged); port 1 get's vLan 20 (tagged), it's the main router; and no other port gets that vLan's traffic. The router only has the one network connection. Is this ideal, probably not, but there's nothing wrong or insecure with the way it's setup.