I did the thing in Instruments that shows info about the object that was sent a message, but memory addresses are less than useful compared the actual name of the variable. Is there a way to find out what it's identifier was?
Try adding symbolic breakpoints such as:
[NSException raise]
objc_exception_throw
malloc_error_break
Also try enabling NSZombies and you should be able to see the line of code that calls the release on the deallocated instance.