It looks like you have a zombie - you have a situation where you use the code after you have released it. The save count reaches zero, so the system cancels and reuses the memory, then you make the change through the original link. Now you have two different references to the same memory, each of which expects a different object. In your case, one of the links is within a barrage.
The reason for the differences in your device / simulator is the different memory allocation schemes used by the two architectures: it seems that the simulator uses memory very aggressively.
Enable NSZombie and run in the debugger. If you're lucky, this will give you the object and the point that it used after freeing.
Enable NSZombie: Product menu, Change Scheme ..., Run, Diagnostics tab, check Enable zombie objects.
source share