ABPeoplePicker Crash for Only One Person

I have an app that only crashes for one of my tester’s - no one else’s. But it crashes consistently for her. It’s very odd.

Details:
She has in iPhone 4 and an iPhone 3Gs
The app crashes on all OSes on BOTH phones
The app crashes with all contacts no matter how they were created
When she sends me her contacts they work fine on both my iPHone 4 and my 3G (not s)
She is the ONLY one that ever gets a crash and it is consistent across both phones and all OSes
She has uninstalled and reinstalled the app and the provisioning profile
She is syncing her iPhone with a windows machine version of iTunes

The crash happens when we use ABPeoplePicker.
From her perspective it looks like the minute she selects a phone number the app crashes. Of course she is not in our app at that moment. She is in the ABPeoplePicker navigation view provided by Apple. From the resymbolicated crash log it looks to me like it’s actually crashing when it is trying to return to our app. In other words I can’t find any mention of our app actually being responsible for the crash in the crash log (see below). It looks like it’s not able to get the index of the selected phone number and then fails when trying to pop back into our app but that’s a guess at best. I have read the Apple docs and tried to do due diligence in learning about how to read crash logs but I am still stumped. Here are my questions:
1. Does anyone know what Exception Codes: 0x00000000, 0x00000000 means?
2. Am I correct in assuming that line 9 is where the actual issues is referred to? And if so how do I understand what objc_exception_throw + 64 means?
3. Can anyone shed some light on what this crash log says the problem is?

Incident Identifier: 
CrashReporter Key:   
Hardware Model:      iPhone3,1
Process:         My App [471]
Path:            
Identifier:      My App
Version:         ??? (???)
Code Type:       ARM (Native)
Parent Process:  launchd [1]

Date/Time:       2010-12-06 16:32:44.088 -0600
OS Version:      iPhone OS 4.0.2 (8A400)
Report Version:  104

Exception Type:  EXC_CRASH (SIGABRT)
Exception Codes: 0x00000000, 0x00000000
Crashed Thread:  0

Thread 0 Crashed:
0   libSystem.B.dylib              0x000791d0 __kill + 8
1   libSystem.B.dylib              0x000791c0 kill + 4
2   libSystem.B.dylib              0x000791b2 raise + 10
3   libSystem.B.dylib              0x0008d6fa abort + 50
4   libstdc++.6.dylib              0x00044a20 __gnu_cxx::__verbose_terminate_handler() + 376
5   libobjc.A.dylib                0x000059ec _objc_terminate + 104
6   libstdc++.6.dylib              0x00042df2 __cxxabiv1::__terminate(void (*)()) + 46
7   libstdc++.6.dylib              0x00042e46 std::terminate() + 10
8   libstdc++.6.dylib              0x00042f16 __cxa_throw + 78
9   libobjc.A.dylib                0x000048cc objc_exception_throw + 64
10  CoreFoundation                 0x0001fb72 -[__NSArrayI objectAtIndex:] + 154
11  My App                  0x00005a68 0x1000 + 19048
12  My App                  0x00005dec 0x1000 + 19948
13  UIKit                          0x000668f4 -[UIViewController view] + 104
14  UIKit                          0x000784e4 -[UIViewController contentScrollView] + 16
15  UIKit                          0x00078354 -[UINavigationController _computeAndApplyScrollContentInsetDeltaForViewController:] + 24
16  UIKit                          0x00078252 -[UINavigationController _layoutViewController:] + 18
17  UIKit                          0x00077d58 -[UINavigationController _startTransition:fromViewController:toViewController:] + 372
18  UIKit                          0x00077b68 -[UINavigationController _startDeferredTransitionIfNeeded] + 176
19  UIKit                          0x00066fa8 -[UINavigationController pushViewController:transition:forceImmediate:] + 600
20  UIKit                          0x00066d40 -[UINavigationController pushViewController:animated:] + 28
21  My App                  0x0000a29a 0x1000 + 37530
22  My App                  0x0000bcba 0x1000 + 44218
23  AddressBookUI                  0x00032cfc -[ABPeoplePickerNavigationController personViewController:shouldPerformDefaultActionForPerson:property:identifier:withMemberCell:] + 152
24  AddressBookUI                  0x0003b8ce -[ABPersonViewControllerHelper personTableViewDataSource:selectedPropertyAtIndex:inPropertyGroup:withMemberCell:forEditing:] + 222
25  AddressBookUI                  0x0004a17c -[ABPersonTableViewDataSource valueAtIndex:selectedForPropertyGroup:withMemberCell:forEditing:] + 40
26  AddressBookUI                  0x00048c00 -[ABPersonTableViewDataSource tableView:didSelectRowAtIndexPath:] + 316
27  UIKit                          0x00091f40 -[UITableView _selectRowAtIndexPath:animated:scrollPosition:notifyDelegate:] + 656
28  UIKit                          0x0009db40 -[UITableView _userSelectRowAtIndexPath:] + 124
29  Foundation                     0x00086c86 __NSFireDelayedPerform + 362
30  CoreFoundation                 0x00071a54 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 8
31  CoreFoundation                 0x00073ede __CFRunLoopDoTimer + 854
32  CoreFoundation                 0x0007485e __CFRunLoopRun + 1082
33  CoreFoundation                 0x0001d8e4 CFRunLoopRunSpecific + 224
34  CoreFoundation                 0x0001d7ec CFRunLoopRunInMode + 52
35  GraphicsServices               0x000036e8 GSEventRunModal + 108
36  GraphicsServices               0x00003794 GSEventRun + 56
37  UIKit                          0x000062a0 -[UIApplication _run] + 396
38  UIKit                          0x00004e10 UIApplicationMain + 664
39  My App                  0x0000d694 0x1000 + 50836
40  My App                  0x00002d00 0x1000 + 7424

Here is my ABPeoplePicker code.

#pragma mark ABPeoplePickerNavigationControllerDelegate methods
// Displays the information of a selected person
- (BOOL)peoplePickerNavigationController:(ABPeoplePickerNavigationController *)peoplePicker shouldContinueAfterSelectingPerson:(ABRecordRef)person
{
    return YES;
}

// Does not allow users to perform default actions such as dialing a phone number, when they select a person property.
- (BOOL)peoplePickerNavigationController:(ABPeoplePickerNavigationController *)peoplePicker 
    shouldContinueAfterSelectingPerson:(ABRecordRef)person 
                 property:(ABPropertyID)property 
                                  identifier:(ABMultiValueIdentifier)identifier {

     CFStringRef cfName = ABRecordCopyCompositeName(person);
     self.selectedName = [NSString stringWithString:(NSString *)cfName];
     CFRelease(cfName);

     ABMultiValueRef allThePhoneNums = ABRecordCopyValue(person, kABPersonPhoneProperty);

     // ABMultiValueGetIndexForIdentifier the exact value of the "identifier" passed to us.
     NSString *number = (NSString *)ABMultiValueCopyValueAtIndex(allThePhoneNums, ABMultiValueGetIndexForIdentifier(allThePhoneNums, identifier));

     self.selectedNumber = number;

     [number release];

     CFRelease(allThePhoneNums);

     [self showDialOutToPartViewControllerWithName:self.selectedName andNumber:self.selectedNumber];

     [peoplePicker dismissModalViewControllerAnimated:YES];

     return NO;
 }


 // Dismisses the people picker and shows the application when users tap Cancel. 
 - (void)peoplePickerNavigationControllerDidCancel:(ABPeoplePickerNavigationController *)peoplePicker; {
     [self dismissModalViewControllerAnimated:YES];
 }

Foremost, it helps to symbolicate your crash logs using the symbolicatecrash tool and the DSYM file that was generated when you compiled it. I won't discuss how to do that here -- you can search Google to find more details; try "symbolicate crash log DSYM" as keywords.

Once you do that, instead of:

My App      0x0232032+433

It will show something like this:

My App      [className callSomeMethod:argument]

Much easier to find the line of code that is spawning the problem.

However - note in the stack trace that the last line of code is [array objectAtIndex:] in Foundation. This method will throw an NSRangeException when you pass an index outside of the bounds of the receiver (e.g. array). From the NSArray docs:

If index is beyond the end of the array (that is, if index is greater than or equal to the value returned by count), an NSRangeException is raised.

So, I'd put my money on that being your crash.

Then the question is - after you symbolicate your crash log - what line of your code is calling an array with an out-of-bounds index?