FWIW, in _PyType_Lookup I see the "300" PyLong being cached, and later, just before the segfault, I see its address getting out of the cache (a cache hit) but it's no longer a PyLong, it's scrambled, so we're getting a real pointer with scrambled values on the line:

    attribute = _PyType_Lookup(type, name);

segfaulting two lines later in:

    descrgetfunc local_get = Py_TYPE(attribute)->tp_descr_get

When I write scrambled value I mean: 

    (gdb) p *attribute                                                                                                         
    $21 = {_ob_next = 0xdbdbdbdbdbdbdbdb, _ob_prev = 0xdbdbdbdbdbdbdbdb, ob_refcnt = -2604246222170760229, ob_type = 0xdbdbdbd\
    bdbdbdbdb}                                                                                                                 

To debug interactive session in GDB I used:

    r -i weird.py < stdin

with "proxy.x" in the stdin file.