Fixes #4446 See https://github.com/python/cpython/issues/123821 It's possible this is too strict? We could instead do this anytime the AST safety check fails, but feels weird to have that happen non-deterministically