Same in test_codeccallbacks:

test_badhandlerresults (test.test_codeccallbacks.CodecCallbackTest) ... ==11604== Invalid read of size 1
==11604==    at 0x44AF37: _PyUnicode_DecodeUnicodeInternal (unicodeobject.c:6133)
==11604==    by 0x4DEB5C: unicode_internal_decode (_codecsmodule.c:251)
==11604==    by 0x5093F6: PyObject_Call (abstract.c:2082)
==11604==    by 0x47D7F2: PyEval_CallObjectWithKeywords (ceval.c:3942)
==11604==    by 0x491C38: PyCodec_Decode (codecs.c:403)
==11604==    by 0x459D7D: PyUnicode_Decode (unicodeobject.c:3129)
==11604==    by 0x45A287: PyUnicode_FromEncodedObject (unicodeobject.c:3023)
==11604==    by 0x519A45: bytes_decode (bytesobject.c:2320)
==11604==    by 0x484AB8: PyEval_EvalFrameEx (ceval.c:4374)
==11604==    by 0x485ACB: PyEval_EvalFrameEx (ceval.c:4150)
==11604==    by 0x486779: PyEval_EvalCodeEx (ceval.c:3433)
==11604==    by 0x4859CA: PyEval_EvalFrameEx (ceval.c:4160)
==11604==  Address 0xfa1f8a2 is 0 bytes after a block of size 34 alloc'd
==11604==    at 0x4C27972: realloc (vg_replace_malloc.c:525)
==11604==    by 0x51AC34: _PyBytes_Resize (bytesobject.c:2881)
==11604==    by 0x51C338: PyBytes_DecodeEscape (bytesobject.c:495)
==11604==    by 0x56E871: ast_for_expr (ast.c:3837)
==11604==    by 0x570562: ast_for_testlist (ast.c:1106)
==11604==    by 0x56E859: ast_for_expr (ast.c:1881)
==11604==    by 0x570562: ast_for_testlist (ast.c:1106)
==11604==    by 0x56E859: ast_for_expr (ast.c:1881)
==11604==    by 0x5715C4: ast_for_stmt (ast.c:3302)
==11604==    by 0x5724F8: ast_for_suite (ast.c:3086)
==11604==    by 0x5715E3: ast_for_stmt (ast.c:3305)
==11604==    by 0x5724F8: ast_for_suite (ast.c:3086)

_PyUnicode_DecodeUnicodeInternal (s=0xfa1f8a0 "", size=<value optimized out>, errors=
    0xf652fa0 "test.badhandler") at Objects/unicodeobject.c:6133
6133            ((char *) &uch)[2] = s[2];



[...]
_PyUnicode_DecodeUnicodeInternal (s=0xfa1f8a0 "", size=<value optimized out>, errors=
    0xf652fa0 "test.badhandler") at Objects/unicodeobject.c:6134
6134            ((char *) &uch)[3] = s[3];