Finding source of over release

I'm consistently seeing the same message sent in as a crash report from users of an app. It's clear that an object is being over-released but I'm unable to replicate it and I'm looking for tips on tracing the source of it.

The relevant section from the crash report shows this:

Application Specific Information:
objc_msgSend() selector name: release

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   libobjc.A.dylib                     0x90892edb objc_msgSend + 27
1   com.apple.CoreFoundation            0x95ec5a40 __CFBasicHashStandardCallback + 384
2   com.apple.CoreFoundation            0x95ec564e __CFBasicHashDrain + 478
3   com.apple.CoreFoundation            0x95ead6f1 _CFRelease + 353
4   com.apple.CoreFoundation            0x95eda0ed _CFAutoreleasePoolPop + 253
5   com.apple.Foundation                0x97ecedd6 NSPopAutoreleasePool + 76
6   com.apple.Foundation                0x97ececfe -[NSAutoreleasePool drain] + 130
7   com.apple.AppKit                    0x9211255f -[NSApplication run] + 1013
8   com.apple.AppKit                    0x9210a535 NSApplicationMain + 574
9   TheApp                          0x000020a6 start + 54

I've used zombies and leaks, but haven't seen anything there. I've gone through the code and can't see it.

What's the next step? Are there any hints I can discern from this information as to the source of it?

Does the fact that this nearly exact same crash report is coming in repeatedly mean that it's the same object that's being over released, or because this is referring to the autorelease pool mean it could be any object?

Does the reference to _CFRelease mean it's a Core Foundation object that's being over released?

I've used zombies and leaks, but haven't seen anything there.

That's strange.

What's the next step?

The next step for an over-release crash is generally to run the app using Instruments' Zombies template. The second release message will raise a flag in Instruments' timeline graph, with a button you can click to find out more information.

Also try building your app with the static analyzer in Xcode 3.2 or later.

Does the fact that this nearly exact same crash report is coming in repeatedly mean that it's the same object that's being over released, or because this is referring to the autorelease pool mean it could be any object?

It could be any object, but is almost certainly the same object every time, unless you are doing memory management wrong all over your code base.

Does the reference to _CFRelease mean it's a Core Foundation object that's being over released?

No.