PyDict_GetItem() returns a borrowed reference.

There are probably a number of places that are open to attacks
such as the following one, in bltinmodule.c:min_max().

Lib/test/crashers/borrowed_ref_3.py

+"""
+PyDict_GetItem() returns a borrowed reference.
+There are probably a number of places that are open to attacks
+such as the following one, in bltinmodule.c:min_max().
+"""
+
+class KeyFunc(object):
+    def __call__(self, n):
+        del d['key']
+        return 1
+
+
+d = {'key': KeyFunc()}
+min(range(10), **d)