Have you seen this crash?
Here’s one I ran into while writing BZ Soundboard.
#0 0x9073fba4 in CFRetain () #1 0x92964b60 in _NSKeyValueObservationInfoCreateByRemoving () #2 0x92964938 in -[NSObject(NSKeyValueObserverRegistration) _removeObserver:forProperty:] () #3 0x92964828 in -[NSObject(NSKeyValueObserverRegistration) removeObserver:forKeyPath:] ()
I solved this one on a hunch — that the NULL being CFRetained (print $r3 in gdb to see the first function argument) was the result of some kind of lookup with the proposed ex-observer as the key. If the ex-observer was not actually observing anything, the lookup would return nil or NULL, and apparently that result is not checked before it is passed to CFRetain.
Executive summary: If you get this crash, it means that you were not actually observing anything (or at least not that key path).