homepage

This is really short, you should spot the inconsistency in the result of the same function call fairly easily.
Python 3.3.0 (v3.3.0:bd8afb90ebf2, Sep 29 2012, 01:25:11) 
[GCC 4.2.1 (Apple Inc. build 5666) (dot 3)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> class Thing:
... def method(self):
... print(__class__)
... 
>>> x = Thing.method.__closure__[0]
>>> dir(x)
Traceback (most recent call last):
 File "<stdin>", line 1, in <module>
TypeError: object does not provide __dir__
>>> type(x).__dir__(x)
['__gt__', '__eq__', '__setattr__', '__doc__', '__sizeof__', '__str__', '__init__', '__repr__', 'cell_contents', '__dir__', '__ge__', '__class__', '__new__', '__ne__', '__subclasshook__', '__hash__', '__lt__', '__reduce__', '__le__', '__getattribute__', '__format__', '__reduce_ex__', '__delattr__']
>>> dir(x)
['__class__', '__delattr__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__getattribute__', '__gt__', '__hash__', '__init__', '__le__', '__lt__', '__ne__', '__new__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__', 'cell_contents']
>>>

Here is a somewhat simpler way to reproduce (following the same definition of x):
>>> dir(x)
 ...
TypeError: object does not provide __dir__
>>> x.__dir__
<built-in method __dir__ of cell object at 0x10c182950>
>>> dir(x)
['__class__', '__delattr__', '__dir__', '__doc__', '__eq__', '__format__', '__ge__', '__getattribute__', '__gt__', '__hash__', '__init__', '__le__', '__lt__', '__ne__', '__new__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__', 'cell_contents']
The dir() documentation says, "If the object has a method named __dir__(), this method will be called and must return the list of attributes."
(from http://docs.python.org/py3k/library/functions.html#dir )

This rather obscure bug seems to be caused by a failure to properly initialize PyCell_Type.
Running with GDB, we see that _PyType_Lookup(<class 'cell'>, "__dir__") 
fails in:
 /* Look in tp_dict of types in MRO */
 mro = type->tp_mro;
 /* If mro is NULL, the type is either not yet initialized
 by PyType_Ready(), or already cleared by type_clear().
 Either way the safest thing to do is to return NULL. */
 if (mro == NULL)
 return NULL;
Since:
 (gdb) print PyCell_Type->tp_mro
 9ドル = (PyObject *) 0x0
Searching the code base shows that we never call PyType_Ready(&PyCell_Type).
A patch is attached.

Note that we fail to initialize PyCell_Type in all versions of Python, even if there aren't any visible ramifications in earlier versions.

The same fix, but with a unit test.
Note that object.__dir__ did not exist in previous versions, but I found a similar failure with __format__, which also applies to 2.7.

Your patch looks good to me, and I can verify that it properly tests for the issue in Python 3.3.
On a related note, I've found that PyType_Ready(...) isn't called for a few other core PyTypeObjects... see #16369.