homepage

Logged In: NO 
Barry - the new docs just went up and they're a big
improvement over the old. However the sentence 
"The issue here is usually not that a class's constructor
will get called -- it won't by the unpickler -- but that the
class's destructor (i.e. its __del__() method) might get
called when the object is garbage collected." isn't
correct. 
There's a flag in the pickle stream that tells
the unpickler that the pickler found a __getinitargs__
method at pickling time. If the flag is set in the pickle,
then the unpickler calls the class constructor, whether
there's a __getinitargs__ method in the class or not.
The sample exploit that I posted earlier on,
<http://www.nightsong.com/phr/python/pickletest.py>,
is an example of an artificially concocted pickle that
makes a class constructor get called.