> The fact it fails only the second time is by design, although I'm not
> sure the design is useful, and it's probably not documented anywhere.

It helped me debug a number of interpreter crashes in 3.0. When a stack
overflow occurred, in certain cases, the interpreter would catch the
exception, and consider it as failure in the callback it tried to invoke
(e.g. when invoking __eq__ during dictionary lookups). Rather than
letting the stack unwind, it would continue to let the stack overflow,
and eventually managed to crash the entire process. The recovery check
is there to detect that, after a stack overflow, it really unwound a
sufficient number of stack frames, rather than overflowing again and
again.