Debug / play EXC_BAD_ACCESS crash in CA :: release_objects

Question

I use Crashlytics to track crashes, and I see some crashes with the stack trace below:

Crash: com.apple.main-thread EXC_BAD_ACCESS KERN_INVALID_ADDRESS at 0xf8560b1c

Thread : Crashed: com.apple.main-thread
0  libobjc.A.dylib                0x37a20b66 objc_msgSend + 5
1  CoreFoundation                 0x2d5f8e8d CFRelease + 560
2  QuartzCore                     0x2fad2965 CA::release_objects(X::List<void const*>*) + 16
3  QuartzCore                     0x2fad7dcf -[CAAnimation dealloc] + 54
4  libobjc.A.dylib                0x37a30b0b objc_object::sidetable_release(bool) + 174
5  CoreFoundation                 0x2d5f8e8d CFRelease + 560
6  QuartzCore                     0x2fada419 CA::Layer::run_animation_callbacks(void*) + 240
7  libdispatch.dylib              0x37f0a0af _dispatch_client_callout + 22
8  libdispatch.dylib              0x37f0c9a9 _dispatch_main_queue_callback_4CF + 268
9  CoreFoundation                 0x2d6935b1 __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 8
10 CoreFoundation                 0x2d691e7d __CFRunLoopRun + 1308
11 CoreFoundation                 0x2d5fc471 CFRunLoopRunSpecific + 524
12 CoreFoundation                 0x2d5fc253 CFRunLoopRunInMode + 106
13 GraphicsServices               0x323362eb GSEventRunModal + 138
14 UIKit                          0x2feb1845 UIApplicationMain + 1136

It looks like CFRelease is being called on some object twice. The problem is that I don’t know which animation is crashing. Logs are not very useful, as the accident occurs in different places. How can I debug / reproduce this failure or at least register something so that I know which object is fired twice.