pointer being freed was not allocated. Complex malloc history help

I've followed the guides helpfully linked here:

iPhone - debugging "pointer being freed was not allocated" errors

but the malloc_history is really throwing me for a loop, can anyone shed any light on the following:

ALLOC 0x185c600-0x18605ff [size=16384]: thread_a068a4e0 |start | main | UIApplicationMain | -[UIApplication _run] | CFRunLoopRunInMode | CFRunLoopRunSpecific | PurpleEventCallback | _UIApplicationHandleEvent | -[UIApplication sendEvent:] | -[UIApplication handleEvent:withNewEvent:] | -[UIApplication _reportAppLaunchFinished] | CA::Transaction::commit() | CA::Context::commit_transaction(CA::Transaction*) | CALayerCommitIfNeeded | CALayerCommitIfNeeded | CALayerCommitIfNeeded | CALayerCommitIfNeeded | CALayerCommitIfNeeded | CALayerCommitIfNeeded | CA::Context::commit_layer(_CALayer*, unsigned int, unsigned int, void*) | CA::Render::encode_set_object(CA::Render::Encoder*, unsigned long, unsigned int, CA::Render::Object*, unsigned int) | CA::Render::Layer::encode(CA::Render::Encoder*) const | CA::Render::Image::encode(CA::Render::Encoder*) const | CA::Render::Encoder::encode_data_async(void const*, unsigned long, void (*)(void const*, void*), void*) | CA::Render::Encoder::encode_bytes(void const*, unsigned long) | CA::Render::Encoder::grow(unsigned long) | realloc | malloc_zone_realloc 
----
FREE  0x185c600-0x18605ff [size=16384]: thread_a068a4e0 |start | main | UIApplicationMain | -[UIApplication _run] | CFRunLoopRunInMode | CFRunLoopRunSpecific | PurpleEventCallback | _UIApplicationHandleEvent | -[UIApplication sendEvent:] | -[UIApplication handleEvent:withNewEvent:] | -[UIApplication _reportAppLaunchFinished] | CA::Transaction::commit() | CA::Context::commit_transaction(CA::Transaction*) | CALayerCommitIfNeeded | CALayerCommitIfNeeded | CALayerCommitIfNeeded | CALayerCommitIfNeeded | CALayerCommitIfNeeded | CALayerCommitIfNeeded | CA::Context::commit_layer(_CALayer*, unsigned int, unsigned int, void*) | CA::Render::encode_set_object(CA::Render::Encoder*, unsigned long, unsigned int, CA::Render::Object*, unsigned int) | CA::Render::Layer::encode(CA::Render::Encoder*) const | CA::Render::Image::encode(CA::Render::Encoder*) const | CA::Render::Encoder::encode_data_async(void const*, unsigned long, void (*)(void const*, void*), void*) | CA::Render::Encoder::encode_bytes(void const*, unsigned long) | CA::Render::Encoder::grow(unsigned long) | realloc | malloc_zone_realloc 

ALLOC 0x185e000-0x185e62f [size=1584]: thread_a068a4e0 |start | main | UIApplicationMain | GS开发者_开发百科EventRun | GSEventRunModal | CFRunLoopRunInMode | CFRunLoopRunSpecific | __NSFireDelayedPerform | -[UITableView _userSelectRowAtIndexPath:] | -[UITableView _selectRowAtIndexPath:animated:scrollPosition:notifyDelegate:] | -[PLAlbumView tableView:didSelectRowAtIndexPath:] | -[PLUIAlbumViewController albumView:selectedPhoto:] | PLNotifyImagePickerOfImageAvailability | -[UIImagePickerController _imagePickerDidCompleteWithInfo:] | -[GalleryViewController imagePickerController:didFinishPickingMediaWithInfo:] | UIImageJPEGRepresentation | CGImageDestinationFinalize | _CGImagePluginWriteJPEG | writeOne | _cg_jpeg_start_compress | _cg_jinit_compress_master | _cg_jinit_c_prep_controller | alloc_sarray | alloc_large | malloc | malloc_zone_malloc 
----
FREE  0x185e000-0x185e62f [size=1584]: thread_a068a4e0 |start | main | UIApplicationMain | GSEventRun | GSEventRunModal | CFRunLoopRunInMode | CFRunLoopRunSpecific | __NSFireDelayedPerform | -[UITableView _userSelectRowAtIndexPath:] | -[UITableView _selectRowAtIndexPath:animated:scrollPosition:notifyDelegate:] | -[PL AlbumView tableView:didSelectRowAtIndexPath:] | -[PLUIAlbumViewController albumView:selectedPhoto:] | PLNotifyImagePickerOfImageAvailability | -[UIImagePickerController _imagePickerDidCompleteWithInfo:] | -[GalleryViewController imagePickerController:didFinishPickingMediaWithInfo:] | UIImageJPEGRepresentation | CGImageDestinationFinalize | _CGImagePluginWriteJPEG | writeOne | _cg_jpeg_abort | free_pool | free 

ALLOC 0x185c800-0x185ea1f [size=8736]: thread_a068a4e0 |start | main | UIApplicationMain | GSEventRun | GSEventRunModal | CFRunLoopRunInMode | CFRunLoopRunSpecific | __NSFireDelayedPerform | -[UITableView _userSelectRowAtIndexPath:] | -[UITableView _selectRowAtIndexPath:animated:scrollPosition:notifyDelegate:] | -[PLAlbumView tableView:didSelectRowAtIndexPath:] | -[PLUIAlbumViewController albumView:selectedPhoto:] | PLNotifyImagePickerOfImageAvailability | -[UIImagePickerController _imagePickerDidCompleteWithInfo:] | -[GalleryViewController imagePickerController:didFinishPickingMediaWithInfo:] | -[UIImage initWithData:] | _UIImageRefFromData | CGImageSourceCreateImageAtIndex | makeImagePlus | _CGImagePluginInitJPEG | initImageJPEG | calloc | malloc_zone_calloc 

You could use the "Build and Analyze" function of XCode. It's in the menu under "Build". Maybe this analyzer will give you a hint.

I'm initialising the UIIMagePickerController as below, and another method is accepting the results.

-(void)addImage{
    NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];     

    if (![UIImagePickerController isSourceTypeAvailable:UIImagePickerControllerSourceTypePhotoLibrary]) {
        return;
    }

    if(photoPicker == NULL) {
        photoPicker = [[UIImagePickerController alloc] init];
        photoPicker.delegate = self;
        photoPicker.allowsImageEditing = NO;
    }

    photoPicker.sourceType = UIImagePickerControllerSourceTypePhotoLibrary;

    [self presentModalViewController:photoPicker animated:YES];
    [pool release];
}