Found the next crasher by thinking about this logic in PyPy.

Lib/test/crashers/slot_tp_new.py

@@ -0,0 +1,11 @@
+"""
+Infinite C recursion involving PyObject_GetAttr in slot_tp_new.
+"""
+
+class X(object):
+    class __metaclass__(type):
+        pass
+    __new__ = 5
+
+X.__metaclass__.__new__ = property(X)
+print X()