I worked some on trying to create a unit test this evening.  Attached is my best result so far (gc_weakref_bug_demo.py).  It requires that you enable the 'xx' module so we have a container object without tp_traverse.  We should probably add one to _testcapi for the real unit test so we have it.

I can make the weakref callback run from within delete_garbage().  I haven't been able to make tp_clear for the function execute before the callback and I think that is needed to replicate the crash in this bug report.