Serhiy's fixes (thanks!) are now released in 3.7.0rc2 and 3.6.7rc2 so I'm removing the "release blocker" status.  If there is nothing more to be done for this issue, can we close it?

shuoz:
> oh brother, maybe this worth open a cve.

Note that Serhiy believes that this is not a security issue since it is unlikely that the crash can be triggered by user data.  Anyone can cause segfaults or do damage if they have unrestricted access to a Python interpreter; that's a threat model for any language that allows sometime like Python's os.system or subprocess.  A better question is can a user of an application written in Python likely cause a DOS or create a privilege escalation.  Is that the case here?