How do I find out where a message is being sent from?
===

Our app is crashing during our tests, sending a message to a deallocated `UINavigationItem`.  I've looked using Instruments, but all the releases and retains look balanced; it looks like something is hanging onto the variable without retaining it.  I'd like to find where the message is being sent from, so that I can make sure that the object stays alive long enough to receive it.

The error in the console is:

    -[UINavigationItem safeValueForKey:]: message sent to deallocated instance 0x11afab80

The stack trace is:

     0 CoreFoundation ___forwarding___
     1 CoreFoundation _CF_forwarding_prep_0
     2 UIKit -[UINavigationItemButtonViewAccessibility(SafeCategory) accessibilityTraits]
     3 UIAccessibility -[NSObject(NSObjectAccessibility) accessibilityAttributeValue:]
     4 UIAccessibility _copyAttributeValueCallback
     5 AXRuntime _AXXMIGCopyAttributeValue
     6 AXRuntime _XCopyAttributeValue
     7 AXRuntime mshMIGPerform
     8 CoreFoundation __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__
     9 CoreFoundation __CFRunLoopDoSource1
    10 CoreFoundation __CFRunLoopRun
    11 CoreFoundation CFRunLoopRunSpecific
    12 CoreFoundation CFRunLoopRunInMode
    13 GraphicsServices GSEventRunModal
    14 GraphicsServices GSEventRun
    15 UIKit UIApplicationMain
    16 118118 Functional Tests main [myapp]/main.m:14
    17 118118 Functional Tests start

...but none of that is in my code.  How do I find out where the message is being sent from?