Have you seen this crash?

here's one I ran into while writing BZ Soundboard.

#0  0x9073fba4 in CFRetain ()
#1  0x92964b60 in _NSKeyValueObservationInfoCreateByRemoving ()
#2  0x92964938 in -[NSObject(NSKeyValueObserverRegistration) _removeObserver:forProperty:] ()
#3  0x92964828 in -[NSObject(NSKeyValueObserverRegistration) removeObserver:forKeyPath:] ()

I solved this one on a hunch — that the NULL being CFRetained (print $r3 in gdb to see the first function argument) was the result of some kind of lookup with the proposed ex-observer as the key. if the ex-observer was not actually observing anything, the lookup would return nil or NULL, and apparently that result is not checked before it is passed to CFRetain.

executive summary: if you get this crash, it means that you were not actually observing anything (or at least not that key path).