I add some problem working arround with this bug, so i decided to fix this issue of NSObject by myself:

// NSObjectKVOCrashFixer.h

1. import

@interface NSObjectKVOCrashFixer : NSObject {

}

@end

// NSObjectKVOCrashFixer.m

1. import “NSObjectKVOCrashFixer.h”

@implementation NSObjectKVOCrashFixer
- (void)_removeObserver:(NSObject *)anObserver forProperty:(id)property
{
if([self observationInfo]!=NULL)
[super _removeObserver:anObserver forProperty:property];
else
NSLog(@”Fixed an Apple crash!”);
}
@end

and

// main.m

1. import
2. import “NSObjectKVOCrashFixer.h”

int main(int argc, char *argv[])
{
[NSObjectKVOCrashFixer poseAsClass:[NSObject class]];
return NSApplicationMain(argc, (const char **) argv);
}

I know this is dirty. But it works and it seems necessary for me until apple check by themselves if value==NULL before doing a CFRelease…