Cannot find over-released object debugging on device

I have a rather large app which works in the simulator but creates in an over-released object scenario on the iPhone device. NSzombies would seem to be the route to go except that the object is not over-released on the simulator and NSZombies does not function on the device. Through hours of logging I seem to be able to pin it down to someplace between when I run -

[locManager startUpdatingLocation] and the start of -

(void)locationManager:(CLLocationManager *)manager didUpdateToLocation:(CLLocation *)newLocation fromLocation:(CLLocation *)oldLocation

That explains why it works on the simulator, I detect no location ability and do not run that location code.

When I NSLog in-line just before and after [locManager startUpdatingLocation] my NSString object is allocated and present. But when the app executes and it hits locationManager: NSLog shows the NSString is deallocated, gone. THis string object has absolutely nothing to do with location handling or functionality. Unrelated NSString. I have commented out all other potential activity, and commented out all explicit release code and can't find the moment it happens.

I'm further frustrated that lldb seems not to support watchpoints and gdb supports them but this version seems that they don't work ! gdb will set a hardware watchpoint and then Xcode says its running but 30 minutes later there is still no visual activity or break.

I'm on Lion, Xcode 4.1.1, and too much coffee.

What approach should I take to find this released NSString object in such a narrow spectrum of activity and limited tools ?

Once upon a time I had a complex case for locating over released object, so I just inherited from this object to MyObject and overriden a retain and release in a following way:

Here is the DebugString.h file:

#import <Foundation/Foundation.h>

@interface DebugString : NSString

@end

And here is the DebugString.m file:

#import "DebugString.h"

@implementation DebugString

- (id) retain {
    NSLog(@"%i", [self retainCount]);
    return [super retain];
}

- (void) release {
    NSLog(@"%i", [self retainCount]);
    [super release];
}

@end

I put a break points inside of this methods and turned them on at the phase when I expected a crash. Afterward I just started to go through this calls one by one and found an issue. It is complex, but it may help sometime and I never saw such approach described in forums. Maybe it will help you also.

Call the location "didUpdate" manually when running in the simulator - at least two calls, timed out about five seconds, after you start up the location manager. That should trigger the same bug as on the phone, then you can use NSZombies.

Also, the simulator SHOULD be able to run location code, I thought that was broken in 4.2 but OK in 4.1.