Hmm… seems I found a bug where capturing an NSError** that is a parameter in an ObjC block and modifying it in a enumeration block on an array causes ARC to not notice the object is still held by the NSError**. It gets deallocated and boom.