The following code causes an assertion failure:

import _json
def _bad_encoder(*args):
    return None

enc = _json.make_encoder(None, None, _bad_encoder, None,
                         'foo', 'bar', None, None, None)

enc(obj='spam', _current_indent_level=4)

This is because encoder_new() (in Modules/_json.c) assumes that the received
encoder() argument is a function that returns a string, and stores it in the
new PyEncoderObject.
When encoder_encode_string() is called (by encoder_listencode_obj()), it
returns whatever the stored encoder() returned, assuming it returned a string.
Then, encoder_listencode_obj() passes this value to _steal_accumulate(), which
passes it to _PyAccu_Accumulate(), which asserts it is a string.

Similarly, the following code also causes an assertion failure (only the obj
argument is different):

import _json
def _bad_encoder(*args):
    return None

enc = _json.make_encoder(None, None, _bad_encoder, None,
                         'foo', 'bar', None, None, None)

enc(obj={'spam': 42}, _current_indent_level=4)

In this case, encoder_listencode_dict() passes whatever encoder_encode_string()
returned, to _PyAccu_Accumulate(), which asserts it is a string.

New changeset 2b382dd by Serhiy Storchaka (Oren Milman) in branch 'master':
bpo-31505: Fix an assertion failure in json, in case _json.make_encoder() received a bad encoder() argument. (bpo-3643)
2b382dd

New changeset 7c24e99 by Serhiy Storchaka (Miss Islington (bot)) in branch '3.6':
[3.6] bpo-31505: Fix an assertion failure in json, in case _json.make_encoder() received a bad encoder() argument. (GH-3643) (bpo-3777)
7c24e99