NSZombies is great for finding references to deallocated objects (a common crash issue). But it is less useful when trying to debug a crash in autorelease, especially if the object in question is very common.
For that, you can enable malloc logging (in the simulator) and really trace where the object in question was allocated.
As stated in this excellent post, with NSZombieEnabled, MallocStackLogging and MallocStackLoggingNoCompact enabled, you can get the PID of the simulator from your debug console, and then run
shell malloc_history from the debugger to get the stack trace.
More great articles:
iPhone Memory Management & Debugging
Debugging Autorelease (not iPhone specific)
More on this topic
not directly related, but a favourite on the topic of objc_msgSend bugs