diff --git a/_drafts/python-object-replacement.md b/_drafts/python-object-replacement.md
index 191e5d9..c033425 100644
--- a/_drafts/python-object-replacement.md
+++ b/_drafts/python-object-replacement.md
@@ -44,7 +44,7 @@ a = [1, 2, 3, 4]
...we are creating a list object with four integers, and binding it to the name
`a`. In graph form:[2]
-
+
In each of the following examples, we are creating new _references_ to the
list object, but we are never duplicating it. Each reference points to the same
@@ -74,7 +74,7 @@ d = wrapper(a)
{% endhighlight %}
-
+
Note that these references are all equal. `a` is no more valid a name for the
list than `b`, `c.data`, or `L` (from the perspective of `d`, which is exposed
@@ -733,9 +733,9 @@ TypeError: readonly attribute
Python clearly doesn't want us to re-bind bound methods, and a reasonable
person would give up here, but we still have a few tricks up our sleeve. Let's
examine the internal C structure of bound methods,
-[`PyMethodObject`](https://github.com/python/cpython/blob/2.7/Include/classobject.h#L31).
+[`PyMethodObject`](https://github.com/python/cpython/blob/2.7/Include/classobject.h#L31):
-
+
The four gray fields of the struct come from
[`PyObject_HEAD`](https://github.com/python/cpython/blob/2.7/Include/object.h#L78),
@@ -790,6 +790,8 @@ Therefore, we can make our replacement like so:
>>> offset = ptrs_in_struct * field_size + ctypes.sizeof(ctypes.c_ssize_t)
>>> ctypes.memmove(id(f) + offset, ctypes.byref(ctypes.py_object(b)), field_size)
4470258440
+>>> f.__self__ is b
+True
>>> f()
<__main__.B object at 0x10a8af290>
@@ -797,7 +799,40 @@ Therefore, we can make our replacement like so:
Excellent—it worked!
-[`PyCFunctionObject`](https://github.com/python/cpython/blob/2.7/Include/methodobject.h#L81)
+There's another kind of bound method, which is the built-in variety as opposed
+to the user-defined variety we saw above. An example is `a.__sizeof__()`:
+
+{% highlight pycon %}
+
+>>> a, b = A(), B()
+>>> f = a.__sizeof__
+>>> f
+
+>>> replace(a, b)
+>>> f.__self__
+<__main__.A object at 0x10ab44b50>
+
+{% endhighlight %}
+
+This is stored internally as a
+[`PyCFunctionObject`](https://github.com/python/cpython/blob/2.7/Include/methodobject.h#L81).
+Let's take a look at its layout:
+
+
+
+Fortunately, `m_self` here has the same offset as `im_self` from before, so we
+can just use the same code:
+
+{% highlight pycon %}
+
+>>> ctypes.memmove(id(f) + offset, ctypes.byref(ctypes.py_object(b)), field_size)
+4474703768
+>>> f.__self__ is b
+True
+>>> f
+
+
+{% endhighlight %}
### Dictionary keys