The remaining bug is a bit harder.  If you try to run unpickle-bug-2.py on the same pickle, you get

$ python3 unpickle-bug-2.py /tmp/bug.pkl 
<__main__.Bug object at 0x1006a8f40>
Traceback (most recent call last):
  File "unpickle-bug-2.py", line 9, in <module>
    bug = pickle.Unpickler(open(sys.argv[1], 'rb')).load() # doesn't
TypeError: ('__init__() takes exactly 2 arguments (1 given)', <class '__main__.Bug'>, ())


The problem is acknowledged in the source code of instantiate function in _pickle.c:

    /* XXX: The pickle.py module does not create instances this way when the                                             
       args tuple is empty. See Unpickler._instantiate(). */
 

Clearly, this is wrong because pickle.py way succeeds where _pickle does not.


PS: I did not mean to unassign MAL, but I think this is more of alexandre.vassalotti's issue.