diff --git a/Lib/test/test_str.py b/Lib/test/test_str.py
index 044711cad51..de988a88721 100644
--- a/Lib/test/test_str.py
+++ b/Lib/test/test_str.py
@@ -351,6 +351,10 @@ class StrTest(
         self.assertRaises(ValueError, "{:s}".format)
         self.assertRaises(ValueError, "{}".format)
 
+        # issue 6089
+        self.assertRaises(ValueError, "{0[0]x}".format, [None])
+        self.assertRaises(ValueError, "{0[0](10)}".format, [None])
+
         # can't have a replacement on the field name portion
         self.assertRaises(TypeError, '{0[{1}]}'.format, 'abcdefg', 4)
 
diff --git a/Lib/test/test_unicode.py b/Lib/test/test_unicode.py
index 968f64b1616..96c15f03a3c 100644
--- a/Lib/test/test_unicode.py
+++ b/Lib/test/test_unicode.py
@@ -1091,6 +1091,10 @@ class UnicodeTest(
         self.assertRaises(ValueError, u"{:s}".format)
         self.assertRaises(ValueError, u"{}".format)
 
+        # issue 6089
+        self.assertRaises(ValueError, u"{0[0]x}".format, [None])
+        self.assertRaises(ValueError, u"{0[0](10)}".format, [None])
+
         # can't have a replacement on the field name portion
         self.assertRaises(TypeError, u'{0[{1}]}'.format, u'abcdefg', 4)
 
diff --git a/Misc/NEWS b/Misc/NEWS
index 61717a05e2d..2b1630fd2bb 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@ What's New in Python 2.6.3
 Core and Builtins
 -----------------
 
+- Issue #6089: str.format can raise SystemError with certain invalid
+  field specifiers.
+
 - Issue #5994: the marshal module now has docstrings.
 
 - Issue #5981: Fix two minor inf/nan issues in float.fromhex: (1) inf
diff --git a/Objects/stringlib/string_format.h b/Objects/stringlib/string_format.h
index 600e6b04a11..6c531e89c75 100644
--- a/Objects/stringlib/string_format.h
+++ b/Objects/stringlib/string_format.h
@@ -329,8 +329,9 @@ FieldNameIterator_next(FieldNameIterator *self, int *is_attribute,
         *name_idx = get_integer(name);
         break;
     default:
-        /* interal error, can't get here */
-        assert(0);
+        /* Invalid character follows ']' */
+        PyErr_SetString(PyExc_ValueError, "Only '.' or '[' may "
+                        "follow ']' in format field specifier");
         return 0;
     }