Found in Modules/_sqlite/cursor.c:

        self->statement = PyObject_New(pysqlite_Statement,
&pysqlite_StatementTy
pe);
        if (!self->statement) {
            goto error;
        }
        rc = pysqlite_statement_create(self->statement,
self->connection, operation);
        if (rc != SQLITE_OK) {
            self->statement = 0;
            goto error;
        }

Besides the ugliness of allocating the object before passing it to the
"create" function, if pysqlite_statement_create fails, the object is leaked.

Fixed in r64930 (trunk) and r64931 (py3k). Thanks.