NSURLConnection sendSynchronousRequest: fails when using POST

I'm using a custom NSURLCache to intercept calls for certain web pages in order to modify them dynamically. Inside cachedResponseForRequest: I modify the request, then send it out using sendSynchronousRequest. This works very well until you attempt to submit a form. If there is post data it fails.

If i remove the HTTPBody and set the request to GET, it succeeds. But i need it to work with POST. If i send the request asynchronously it also works which is why i can't figure out why the synchronous request fails.

Here's my stack trace:

Date/Time: 2010-01-17 12:37:55.416 -0800
OS Version: iPhone OS 3.1.2 (7D11)
Report Version: 104

Exception Type: EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000001c
Crashed Thread: 2

Thread 2 Crashed:
0 CFNetwork 0x0000b4e4 HTTPMessage::copyHeaderFieldValue(__CFString const*) + 18
1 CFNetwork 0x0000b4c8 CFHTTPMessageCopyHeaderFieldValue + 16
2 CFNetwork 0x0000e022 HTTPProtocol::createStream() + 328
3 CFNetwork 0x0000de8a HTTPProtocol::createAndOpenStream() + 458
4 CFNetwork 0x0000cba2 HTTPProtocol::startLoad() + 278
5 CFNetwork 0x0000c8da URLConnectionLoader::loaderScheduleOriginLoad(_CFURLRequest const*) + 216
6 CFNetwork 0x0000c77c URLConnectionLoader::loaderScheduleLoad(_CFURLRequest const*) + 280
7 CFNetwork 0x0000c5e6 URLConnectionLoader::LoaderConnectionEventQueue::processAllEventsAndConsumePayload(XConnectionEventInfo, long) + 134
8 CFNetwork 0x0000c53a URLConnectionLoader::processEvents() + 60
9 CFNetwork 0x0000a892 URLConnection::multiplexerClientPerform(RunLoopMultiplexer) + 30
10 CFNetwork 0x0000a812 MultiplexerSource::perform() + 86
11 CFNetwork 0x0000a7b2 MultiplexerSource::_perform(void*) + 2
12 CoreFoundation 0x000573a0 CFRunLoopRunSpecific + 1908
13 CoreFoundation 0x00056c18 CFRunLoopRunInMode + 44
14 Foundation 0x0005a998 +[NSURLConnection(NSURLConnectionReallyInternal) _resourceLoadLoop:] + 172
15 Foundation 0x00053ac6 -[NSThread main] + 42
16 Foundation 0x00001d0e __NSThread__main__ + 852
17 libSystem.B.dylib 0x0002b7b0 _pthread_body + 20

As you can see, copyHeaderFieldValue is causing the crash. What I don't understand is why.

EXC_BAD_ACCESS is link to a Bad Release somewhere... put retain everywhere just to see if it works.