phild, as you know, when you prefix an attribute name with an underscore __ , the python interpreter automatically changes the attribute name (mangles) from __attribute to _CLS__attribute , where CLS is the class name.
However when you say
return type(name, (cls, ), { '__dict' : {} })
keys in the dictionary { '__dict' : {} } will not be distorted. __dict remains unchanged.
Thus, D ends with both D._C__dict and D.__dict :
(Pdb) dir(D) ['_C__dict', '__class__', '__delattr__', '__dict', '__dict__', '__doc__', '__format__', '__getattribute__', '__hash__', '__init__', '__module__', '__new__', '__reduce__', '__reduce_ex__', '__repr__', '__setattr__', '__sizeof__', '__str__', '__subclasshook__', '__weakref__', 'addchild', 'getdict', 'setval']
D._C__dict refers to an attribute of class C. Therefore, when you run
C.setval(1, 5)
you change D._C__dict as well as C._C__dict . They are one and the same.