Valgrind detects the bug (unmodified Python):
$ PYTHONMALLOC=debug valgrind ./python ref.py
(...)
==607098== Invalid read of size 8
==607098== at 0x493FBE: subtype_dealloc (typeobject.c:1456)
==607098== by 0x47C914: _Py_Dealloc (object.c:2288)
==607098== by 0x45F6BF: _Py_DECREF (object.h:500)
==607098== by 0x45F70D: _Py_XDECREF (object.h:567)
==607098== by 0x4654F5: dict_dealloc (dictobject.c:2068)
==607098== by 0x47C914: _Py_Dealloc (object.c:2288)
==607098== by 0x668EBE: _Py_DECREF (object.h:500)
==607098== by 0x66E8BE: ast_dealloc (Python-ast.c:764)
==607098== by 0x493FB9: subtype_dealloc (typeobject.c:1450)
(...)