diff --git a/Lib/test/test_str.py b/Lib/test/test_str.py
index 044711c..de988a8 100644
--- a/Lib/test/test_str.py
+++ b/Lib/test/test_str.py
@@ -351,6 +351,10 @@
         self.assertRaises(ValueError, "{:s}".format)
         self.assertRaises(ValueError, "{}".format)
 
+        # issue 6089
+        self.assertRaises(ValueError, "{0[0]x}".format, [None])
+        self.assertRaises(ValueError, "{0[0](10)}".format, [None])
+
         # can't have a replacement on the field name portion
         self.assertRaises(TypeError, '{0[{1}]}'.format, 'abcdefg', 4)
 
diff --git a/Lib/test/test_unicode.py b/Lib/test/test_unicode.py
index 968f64b..96c15f0 100644
--- a/Lib/test/test_unicode.py
+++ b/Lib/test/test_unicode.py
@@ -1091,6 +1091,10 @@
         self.assertRaises(ValueError, u"{:s}".format)
         self.assertRaises(ValueError, u"{}".format)
 
+        # issue 6089
+        self.assertRaises(ValueError, u"{0[0]x}".format, [None])
+        self.assertRaises(ValueError, u"{0[0](10)}".format, [None])
+
         # can't have a replacement on the field name portion
         self.assertRaises(TypeError, u'{0[{1}]}'.format, u'abcdefg', 4)
 
diff --git a/Misc/NEWS b/Misc/NEWS
index 61717a0..2b1630f 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -12,6 +12,9 @@
 Core and Builtins
 -----------------
 
+- Issue #6089: str.format can raise SystemError with certain invalid
+  field specifiers.
+
 - Issue #5994: the marshal module now has docstrings.
 
 - Issue #5981: Fix two minor inf/nan issues in float.fromhex: (1) inf
diff --git a/Objects/stringlib/string_format.h b/Objects/stringlib/string_format.h
index 600e6b0..6c531e8 100644
--- a/Objects/stringlib/string_format.h
+++ b/Objects/stringlib/string_format.h
@@ -329,8 +329,9 @@
         *name_idx = get_integer(name);
         break;
     default:
-        /* interal error, can't get here */
-        assert(0);
+        /* Invalid character follows ']' */
+        PyErr_SetString(PyExc_ValueError, "Only '.' or '[' may "
+                        "follow ']' in format field specifier");
         return 0;
     }