The attached example works in the __add__ and __getattribute__ cases on CPython, but fails in the __getattr__ case. All three cases work as the semantics say they should on Jython, IronPython and PyPy. It's admittedly an obscure use case. There is no reason that __getattr__ should behave differently. The behavior of __add__ and __getattribute__ is the "correct" one, according to the rule that special methods are bound (with __get__) before they are called.
Here is a patch for trunk and 2.5 version. It also contains a fix for another crasher (see the tests). I only tested the 2.5 patch, because I don't have the tools for the trunk installed.