EXC_BAD_ACCESS in objc_release (due to URLByResolvingBookmarkData?)

Question

I am trying to use URLByResolvingBookmarkData to retrieve a stored security-scoped bookmark, but I'm running into problems.

I'm using a third-party library (wxWidgets) that wraps the function call in an NSAutoreleasePool. Everything seems to work just fine, except when that pool is released, I get an EXC_BAD_ACCESS crash in objc_release, specifically:

frame #0: 0x00007fff7b2d4184 libobjc.A.dylib objc_release + 36
frame #1: 0x00007fff7b2d5087 libobjc.A.dylib (anonymous namespace)::AutoreleasePoolPage::pop(void*) + 817
frame #2: 0x00007fff540aaa56 CoreFoundation _CFAutoreleasePoolPop + 22
frame #3: 0x00007fff561e7b56 Foundation -[NSAutoreleasePool release] + 144
...

I've narrowed it down to this section of code:

NSData *bookmarkData = [NSData dataWithBytes:data length:len];

NSURL *url = [NSURL URLByResolvingBookmarkData:bookmarkData
        options:NSURLBookmarkResolutionWithSecurityScope
        relativeToURL:nil
        bookmarkDataIsStale:&bookmarkDataIsStale
        error:&error];

If I return before URLByResolvingBookmarkData, or if I change it to NSURL *url = [[NSURL alloc] init], things work fine: the pool can be released without a crash. (I mean, it doesn't work properly, since the bookmark isn't resolved, but at least it doesn't crash.)

In fact, I have a non-sandboxed build of the same application that is otherwise identical (being non-sandboxed, it doesn't use this particular piece of code so it's just #ifdefed out) and runs without a problem.

Is there something obviously stupid I'm doing in using URLByResolvingBookmarkData? (I've also tried initByResolvingBookmarkData with the same effect.)