App rejected for crash on launch, but cannot replicate in either simulator or device, and device log is cryptic

I recently had an app rejected for crashing on launch on an iPhone 5 in iOS 5.0, and the good folks at Apple attached a crash report. However, I can't replicate this crash on either my device (also an iPhone 4 running iOS 5) or in the simulator for iOS 5. And, as you can see from the copy below, the report is cryptic. The crash is taking place in thread 5, which helpfully includes ??? where information should be.

First question - is this crash report symbolicated wrong? I kept the dSYM and dragged to the Organizer as per the guidelines.

If it is symbolicated right, I'm at a loss. I've checked through the warnings (all semantic, nothing that seems it could be a malloc/over-release problem), checked memory allocations, ran with NSZombie and malloc guards etc., but nothing seems wrong.

Can anyone help? Much appreciated, thanks.

Incident Identifier: 63777680-AF77-44B8-8264-47CF89D32C28
CrashReporter Key:   66ff952824b039efb0379c6c6fe11a2e035c7573
Hardware Model:      iPhone3,1
Process:         ---- [4453]
Path:            /var/mobile/Applications/8F6C5D92-2052-4C56-9897-D6C50C1A7DA1/----/----
Identifier:      ----
Version:         ??? (???)
Code Type:       ARM (Native)
Parent Process:  launchd [1]

Date/Time:       2011-10-18 12:58:50.611 -0700
OS Version:      iPhone OS 5.0 (9A334)
Report Version:  104

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x00157550
Crashed Thread:  5

Thread 0 name:  Dispatch queue: com.apple.main-thread
Thread 0:
0   libsystem_kernel.dylib          0x31dff060 semaphore_wait_trap + 8
1   libdispatch.dylib               0x32554124 _dispatch_semaphore_wait_slow + 184
2   libdispatch.dylib               0x32554154 dispatch_semaphore_wait$VARIANT$up + 28
3   libxpc.dylib                    0x3514189a xpc_connection_send_message_with_reply_sync + 206
4   SystemConfiguration             0x356dfbe6 _reach_server_target_status + 938
5   SystemConfiguration             0x356e0d56 __SCNetworkReachabilityServer_targetStatus + 14
6   SystemConfiguration             0x356c9aee __SCNetworkReachabilityGetFlags + 198
7   SystemConfiguration             0x356cabc4 reachPerform + 240
8   CoreFoundation                  0x30afeafc __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 8
9   CoreFoundation                  0x30afe35e __CFRunLoopDoSources0 + 358
10  CoreFoundation                  0x30afd06e __CFRunLoopRun + 646
11  CoreFoundation                  0x30a804d6 CFRunLoopRunSpecific + 294
12  CoreFoundation                  0x30a8039e CFRunLoopRunInMode + 98
13  GraphicsServices                0x336aefe6 GSEventRunModal + 150
14  UIKit                           0x32af273c UIApplicationMain + 1084
15  -----                       0x000022f2 0x1000 + 4850
16  -----                       0x000022bc 0x1000 + 4796

Thread 1 name:  Dispatch queue: com.apple.libdispatch-manager
Thread 1:
0   libsystem_kernel.dylib          0x31dff3b4 kevent + 24
1   libdispatch.dylib               0x32553e78 _dispatch_mgr_invoke + 708
2   libdispatch.dylib               0x32553b96 _dispatch_mgr_thread + 30

Thread 2:
0   libsystem_kernel.dylib          0x31e0fcd4 __workq_kernreturn + 8
1   libsystem_c.dylib               0x362c230a _pthread_wqthread + 610
2   libsystem_c.dylib               0x362c209c start_wqthread + 0

Thread 3 name:  WebThread
Thread 3:
0   libsystem_kernel.dylib          0x31dff010 mach_msg_trap + 20
1   libsystem_kernel.dylib          0x31dff206 mach_msg + 50
2   CoreFoundation                  0x30afe41c __CFRunLoopServiceMachPort + 120
3   CoreFoundation                  0x30afd154 __CFRunLoopRun + 876
4   CoreFoundation                  0x30a804d6 CFRunLoopRunSpecific + 294
5   CoreFoundation                  0x30a8039e CFRunLoopRunInMode + 98
6   WebCore                         0x37314128 _ZL12RunWebThreadPv + 396
7   libsystem_c.dylib               0x362c7c16 _pthread_start + 314
8   libsystem_c.dylib               0x362c7ad0 thread_start + 0

Thread 4:
0   libsystem_kernel.dylib          0x31e0fcd4 __workq_kernreturn + 8
1   libsystem_c.dylib               0x362c230a _pthread_wqthread + 610
2   libsystem_c.dylib               0x362c209c start_wqthread + 0

Thread 5 Crashed:
0   ???                             0x00157550 0 + 1406288
1   ???                             0x626b5ef8 0 + 1651203832

Thread 6:
0   libsystem_kernel.dylib          0x31e0fcd4 __workq_kernreturn + 8
1   libsystem_c.dylib               0x362c230a _pthread_wqthread + 610
2   libsystem_c.dylib               0x362c209c start_wqthread + 0

Thread 7:
0   libsystem_kernel.dylib          0x31e0fcd4 __workq_kernreturn + 8
1   libsystem_c.dylib               0x362c230a _pthread_wqthread + 610
2   libsystem_c.dylib               0x362c209c start_wqthread + 0

Thread 5 crashed with ARM Thread State:
r0: 0x00157550    r1: 0x0000013a      r2: 0x00000001      r3: 0x00000000
r4: 0x00157550    r5: 0x00048e20      r6: 0x05395ef0      r7: 0x33e83857
r8: 0x00000000    r9: 0x0000003b     r10: 0x00000001     r11: 0x053960cc
ip: 0x0001ee79    sp: 0x05395e78      lr: 0x00011acf      pc: 0x00157550
cpsr: 0x20000010

This looks like a crash of non-threadsafe web work. try running the zombie instrument