The problem is in CTextIOWrapperTest.test_issue1395_5
Here is the backtrace:

 	msvcr100d.dll!memset()  Line 145	Asm
>	msvcr100d.dll!_heap_alloc_dbg_impl(unsigned __int64 nSize, int nBlockUse, const char * szFileName, int nLine, int * errno_tmp)  Line 498	C++
 	msvcr100d.dll!_nh_malloc_dbg_impl(unsigned __int64 nSize, int nhFlag, int nBlockUse, const char * szFileName, int nLine, int * errno_tmp)  Line 239 + 0x22 bytes	C++
 	msvcr100d.dll!_nh_malloc_dbg(unsigned __int64 nSize, int nhFlag, int nBlockUse, const char * szFileName, int nLine)  Line 302 + 0x2a bytes	C++
 	msvcr100d.dll!malloc(unsigned __int64 nSize)  Line 56 + 0x21 bytes	C++
 	python27_d.dll!PyObject_Malloc(unsigned __int64 nbytes)  Line 944	C
 	python27_d.dll!_PyObject_DebugMallocApi(char id, unsigned __int64 nbytes)  Line 1445 + 0xa bytes	C
 	python27_d.dll!_PyObject_DebugMalloc(unsigned __int64 nbytes)  Line 1413	C
 	python27_d.dll!PyString_FromStringAndSize(const char * str, __int64 size)  Line 88 + 0x11 bytes	C
 	python27_d.dll!do_mkvalue(const char * * p_format, char * * p_va, int flags)  Line 427 + 0xf bytes	C
 	python27_d.dll!va_build_value(const char * format, char * va, int flags)  Line 537 + 0x14 bytes	C
 	python27_d.dll!_Py_VaBuildValue_SizeT(const char * format, char * va)  Line 511	C
 	python27_d.dll!_PyObject_CallMethod_SizeT(_object * o, char * name, char * format, ...)  Line 2671 + 0xf bytes	C
 	python27_d.dll!textiowrapper_tell(textio * self, _object * args)  Line 2222 + 0x2c bytes	C



So the problem happens when calling in textio.c:
{{{
PyObject *decoded = PyObject_CallMethod(
            self->decoder, "decode", "s#", input, 1);
}}}

self->decoder is of type "_io.IncrementalNewlineDecoder" and input is "BBB".

This will result in PyString_FromStringAndSize being called with size = 4294967297, which will cause the server to fall.