In file _elementtree.c

our static code scanner has reported this case, I think there is a bit similar to http://bugs.python.org/issue29874 (returns NULL when NoMemory)

static PyObject*
subelement(PyObject* self, PyObject* args, PyObject* kw)
{
    PyObject* elem;

    ElementObject* parent;
    PyObject* tag;
    PyObject* attrib = NULL;
    if (!PyArg_ParseTuple(args, "O!O|O!:SubElement",
                          &Element_Type, &parent, &tag,
                          &PyDict_Type, &attrib))
        return NULL;

    if (attrib || kw) {
        attrib = (attrib) ? PyDict_Copy(attrib) : PyDict_New();
        if (!attrib)
            return NULL;
        if (kw)
            PyDict_Update(attrib, kw);
    } else {
        Py_INCREF(Py_None);
        attrib = Py_None;
    }

    elem = element_new(tag, attrib);              // <== element_new could returns a NULL pointer, the followed Py_DECREF(elem) would dereference NULL pointer.

    Py_DECREF(attrib);

    if (element_add_subelement(parent, elem) < 0) {
        Py_DECREF(elem);
        return NULL;
    }

New changeset 9c0408d9b68d8f65aad22ca0767f154d6b9f526c by Xiang Zhang in branch '2.7':
bpo-29876: fix DECREF for NULL value in subelement() (GH-760)
https://github.com/python/cpython/commit/9c0408d9b68d8f65aad22ca0767f154d6b9f526c