iPad application crash in Apple review - cannot replicate in simulator, have crash log

I am clearly missing something obvious here and would really appreciate some input. I have tried repeatedly to submit an application to Apple (iPad in this case) that is crashing on their end when testing but I cannot replicated the situation on my end (obviously I only have the damned simulator to work with at this point).

The crash log is as follows:

Date/Time:       2010-04-01 05:39:47.226 -0700
OS Version:      iPhone OS 3.2 (7B367)
Report Version:  104

Exception Type:  EXC_CRASH (SIGABRT)
Exception Codes: 0x00000000, 0x00000000
Crashed Thread:  0

Thread 0 Crashed:
0   libSystem.B.dylib               0x000790a0 __kill + 8
1   libSystem.B.dylib               0x00079090 kill + 4
2   libSystem.B.dylib               0x00079082 raise + 10
3   libSystem.B.dylib               0x0008d20a abort + 50
4   libstdc++.6.dylib               0x00044a1c __gnu_cxx::__verbose_terminate_handler() + 376
5   libobjc.A.dylib                 0x000057c4 _objc_terminate + 104
6   libstdc++.6.dylib               0x00042dee __cxxabiv1::__terminate(void (*)()) + 46
7   libstdc++.6.dylib               0x00042e42 std::terminate() + 10
8   libstdc++.6.dylib               0x00042f12 __cxa_throw + 78
9   libobjc.A.dylib                 0x000046a4 objc_exception_throw + 64
10  CoreFoundation                  0x00090c6e +[NSException raise:format:arguments:] + 74
11  CoreFoundation                  0x00090d38 +[NSException raise:format:] + 28
12  Foundation                      0x00002600 -[NSCFDictionary setObject:forKey:] + 184
13  iPadMosaic                      0x00003282 -[iPadMosaicViewController getAlbumThumbs] (iPadMosaicViewController.m:468)
14  Foundation                      0x000728fe __NSFireDelayedPerform + 314
15  CoreFoundation                  0x00022d1c CFRunLoopRunSpecific + 2092
16  CoreFoundation                  0x000224da CFRunLoopRunInMode + 42
17  GraphicsServices                0x000030d4 GSEventRunModal + 108
18  GraphicsServices                0x00003180 GSEventRun + 56
19  UIKit                           0x000034c2 -[UIApplication _run] + 374
20  UIKit                           0x000019ec UIApplicationMain + 636
21  iPadMosaic                      0x00002234 main (main.m:14)
22  iPadMosaic                      0x00002204 start + 32

My understanding here is that I am botching the Dictionary add somehow. The relevant lines of code are:

for (NSDictionary *album in self.albumList) {
    // Get image for each album cover

    UIImage *albumCover;

    // Loop through photos to get URL of cover based on photo ID match
    NSString *coverURL = @"";
    for (NSDictionary *photo in self.photoList) {
        if ([[photo objectForKey:@"pid"] isEqualToString:[album objectForKey:@"cover_pid"]]) {
            coverURL = [photo objectForKey:@"src"];
        }
    }


    NSURL *albumCoverURL = [NSURL URLWithString:coverURL];
    NSData *albumCoverData = [NSData dataWithContentsOfURL:albumCoverURL];
    albumCover = [UIImage imageWithData:albumCoverData];    

    if (albumCover == nil || albumCover == NULL) {
        //NSLog(@"No album cover for some reason");
        albumCover = [UIImage imageNamed:@"noImage.png"];
    }

    [[self.albumList objectAtIndex:albumCurrent] setObject:albumCover forKey:@"coverThumb"];
}

This is part of a loop that runs over the existing dictionaries stored in an array. If retrieving the album cover fails for some reason the object is filled with a default image and then added. The last line of the code is what's showing up in the crash log.

It runs fine in the simulator but crashes 100% in testing on device apparently. Can anyone tell me what I am missing here?

If Foundation isn't radically changed in from 3.0 to 3.2, then there's only 3 cases an exception is raised in -setObject:forKey::

1. mutating method sent to immutable object
2. attempt to insert nil value
3. attempt to insert nil key

Obviously the 3rd case is impossible, so you only need to check:

1. Is [self.albumList objectAtIndex:albumCurrent] guaranteed to be an NSMutableDictionary?
2. Have you forgotten to include noImage.png in submission?