Found the next crasher by thinking about this logic in PyPy.

diff --git a/Lib/test/crashers/slot_tp_new.py b/Lib/test/crashers/slot_tp_new.py
new file mode 100644 (file)
index 0000000..061d7aa
--- /dev/null
+++ b/Lib/test/crashers/slot_tp_new.py
@@ -0,0 +1,11 @@
+"""
+Infinite C recursion involving PyObject_GetAttr in slot_tp_new.
+"""
+
+class X(object):
+    class __metaclass__(type):
+        pass
+    __new__ = 5
+
+X.__metaclass__.__new__ = property(X)
+print X()