not in restricted mode.

__dict__ can be set to any dictionary; the cl_getattr, cl_setattr and
cl_delattr slots are refreshed.

__name__ can be set to any string.

__bases__ can be set to to a tuple of classes, provided they are not
subclasses of the class whose attribute is being assigned.

__getattr__, __setattr__ and __delattr__ can be set to anything, or
deleted; the appropriate slot (cl_getattr, cl_setattr, cl_delattr) is
refreshed.

(Note: __name__ really doesn't need to be a special attribute, but
that would be more work.)