What about this mailto: openURL might be causing a this malloc crash?

I'm using openURL to send an email w/some links. The function looks like this:

//
+ (void) sendEmail:(NSString *) subject withBody:(NSString *)body {
 NSString *mailString = [NSString stringWithFormat:@"mailto:?@&subject=%@&body=%@",
       [subject stringByAddingPercentEscapesUsingEncoding:NSASCIIStringEncoding],
       [body  stringByAddingPercentEscapesUsingEncoding:NSASCIIStringEncoding]];
 [[UIApplication sharedApplication] openURL:[NSURL URLWithString:mailString]];
 [mailString autorelease];
 }

The code that calls this function looks like this:

[AppNameAppDelegate sendEmail:su开发者_JS百科bjectLine withBody:bodyText];

No matter what the subjectLine and bodyText, I get an error like this:

Program received signal:  “EXC_BAD_ACCESS”.

The email actually pops up, so I know it's making it through that openURL. But by then I guess the program has crashed and so it is not restored when you exit the email pane.

Any ideas on why this is happening?

Issue looks like this but that answer isn't applicable. It looks more like this forum post but unfortunately that issue looks like it was never solved.

UPDATE: When removing the autoreleased mailString (per the instructions in the StackOverflow ticket mentioned above) it does not improve the situation.

//
+ (void) sendEmail:(NSString *) subject withBody:(NSString *)body {
 NSString *mailString = [NSString stringWithFormat:@"mailto:?@&subject=%@&body=%@",
       [subject stringByAddingPercentEscapesUsingEncoding:NSASCIIStringEncoding],
       [body  stringByAddingPercentEscapesUsingEncoding:NSASCIIStringEncoding]];
 [[UIApplication sharedApplication] openURL:[NSURL URLWithString:mailString]];
 }

Setting a malloc_error_break breakpoint does not seem to do anything. The output still looks like this:

AppName(1424,0x3e9097c8) malloc: *** error for object 0x16fdf0: double free
*** set a breakpoint in malloc_error_break to debug

NSString *mailString = [NSString stringWithFormat:...

already returns autoreleased string - you must not sent any autorelease messages to it

Use NSZombieEnabled to debug as I described in this answer.