(gdb) where
#0 objc_msg_lookup (receiver=0x8490bb0, op=0xf76cfb68) at
/opt/Cross/Work/i686-ubuntu-linux-gnu/BUILD/gcc-4.3.3/libobjc/sendmsg.c:224
#1 0xf74811ca in -[NSArrayEnumerator dealloc] (self=0x84915b0,
_cmd=0xf76f5f40) at NSArray.m:1951
#2 0xf7514912 in -[NSObject release] (self=0x84915b0, _cmd=0xf76d0690) at
NSObject.m:1949
#3 0xf7482189 in -[NSAutoreleasePool emptyPool] (self=0x83f96e0,
_cmd=0xf76d06f8) at NSAutoreleasePool.m:404
#4 0xf7481fae in -[NSAutoreleasePool dealloc] (self=0x83f96e0,
_cmd=0xf76d06f0) at NSAutoreleasePool.m:323
#5 0xf7481f63 in -[NSAutoreleasePool release] (self=0x83f96e0, _cmd=0x805eb18)
at NSAutoreleasePool.m:316
#6 0x08057427 in main (argc=-143869376, argv=0x84a8258, env=0x62) at main.m:239
(gdb) p *receiver
$3 = {class_pointer = 0xdeadface}
(gdb)
Looks like a double release?