Here is my revised patch with Martin's code integrated.

Differences:

  - fixed docs
  - added some tests, test_on_errors could still use some refactorings though
  - renamed _rmtree_safe to _rmtree_safe_fd so we can implement more of them
  - _rmtree_safe_fd & _rmtree_unsafe don't need default arguments and the unsafe version also doesn't need argument normalization as both get onerror filled out by rmtree.


If nobody objects, I'd commit it soonish (definitely before Sunday).