This is a known general issue which is documented in Lib/test/crashers/borrowed_ref_1 inside the 2.7 branch.  In trunk, I see that this file has been deleted, although the issue has not been solved in general.  Only the particular crash in the file has been solved.  (Somebody with motivation should restore the crashers that have been solved superficially only.  But finding actual crashing code takes more effort than I'm willing to put into this rather pointless process, so CPython still gets the occasional bug report like this one instead.)