U tried playing around a bit, and managed to get an exception with the -pullsDown message being sent to a GSArrayEnumerator object ... that looked like a retain/release issue (message set to an object which had been deallocated and had the memory used by another object), so I set NSZombieEnabled=YES in the environment and retried. This time the zombie code reported -[NSPopUpButtonCell pullsDown]: message sent to deallocated instance
So hopefully knowing what type of object was prematurely deallocated will help track the issue down.
