GDataXML -[CFString release]: message sent to deallocated instance

Question

Originally I got a annoyingly vague malloc: error for object 0x6ad4590: double free error.
Then I followed the advice in this post and obtained a more useful error: -[CFString release]: message sent to deallocated instance and the following trace stack:

Alloc: Block address: 0x40bd6fe0 length: 32
Stack - pthread: 0xac4292c0 number of frames: 35
0: 0x34d22 in GMmalloc_zone_malloc_internal
1: 0x34ebb in GMmalloc_zone_malloc
2: 0x1610a88 in __CFAllocatorSystemAllocate
3: 0x1610a63 in CFAllocatorAllocate
4: 0x16108de in _CFRuntimeCreateInstance
5: 0x1612d13 in __CFStringCreateImmutableFunnel3
6: 0x161a4be in CFStringCreateWithBytes
7: 0xa6da69 in -[NSPlaceholderString initWithBytes:length:encoding:]
8: 0xa6d9bc in +[NSString stringWithUTF8String:]
9: 0x67e9 in -[GDataXMLNode stringFromXMLString:] at/Users/MyUserName/MyDirectory/MyApp/MyApp/GDataXMLNode.m:372
10: 0x6b27 in -[GDataXMLNode stringValue] at/Users/MyUserName/MyDirectory/MyApp/MyApp/GDataXMLNode.m:434
11: 0x165b4 in -[MyTableViewController continueGetSOAPData] at/Users/MyUserName/MyDirectory/MyApp/MyApp/../MyTableViewController.m:295
12: 0x17f53 in -[FVDashViewController connectionDidFinishLoading:] at/Users/MyUserName/MyDirectory/MyApp/MyApp/../MyTableViewController.m:582
13: 0xb70a49 in ___NSURLConnectionDidFinishLoading_block_invoke_0
14: 0xb6ee84 in __65-[NSURLConnectionInternal_withConnectionAndDelegate:onlyActive:]_block_invoke_0
15: 0xb6fea7 in -[NSURLConnectionInternalConnection invokeForDelegate:]
16: 0xb6ee3f in -[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:]
17: 0xb6efc5 in -[NSURLConnectionInternal _withActiveConnectionAndDelegate:]
18: 0xab3f5a in _NSURLConnectionDidFinishLoading
19: 0x3cdfa39 in_ZN19URLConnectionClient23_clientDidFinishLoadingEPNS_26ClientConnectionEventQueueE
20: 0x3dac596 in_ZN19URLConnectionClient26ClientConnectionEventQueue33processAllEventsAndConsumePayloadEP20ConnectionEventInfoI12XClientEvent18XClientEventParamsEl
21: 0x3dac861 in _ZN19URLConnectionClient26ClientConnectionEventQueue33processAllEventsAndConsumePayloadEP20XConnectionEventInfoI12XClientEvent18XClientEventParamsEl
22: 0x3cd6120 in _ZN19URLConnectionClient13processEventsEv
23: 0x3dac117 in _ZThn52_N25URLConnectionInstanceData24multiplexerClientPerformEv
24: 0x3cd5fbf in _ZN17MultiplexerSource7performEv
25: 0x16e094f in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
26: 0x1643b43 in __CFRunLoopDoSources0
27: 0x1643424 in __CFRunLoopRun
28: 0x1642d84 in CFRunLoopRunSpecific
29: 0x1642c9b in CFRunLoopRunInMode
30: 0x15f57d8 in GSEventRunModal
31: 0x15f588a in GSEventRun
32: 0x16d626 in UIApplicationMain
33: 0x3e65 in main at /Users/MyUserName/MyDirectory/MyApp/MyApp/main.m:16
34: 0x24d5 in start

I'm not very good at debugging, so I have no idea what to make of this. Interestingly enough, the line in my code corresponding to the call to GDataXMLNode stringValue at line 10 of the trace stack is an NSLog statement:

NSLog(@"Element Name: %@", element.stringValue);

If I comment out this line the error disappears, but I'm thinking there is a bigger problem here that is just being masked. Any help appreciated!

****EDIT**** here is the relevant function in GDataXMLNode.h (corresponding to trace stack line #9):

// returns an autoreleased NSString*, from the current node's document strings
// cache if possible
- (NSString *)stringFromXMLString:(const xmlChar *)chars {

#if DEBUG NSCAssert(chars != NULL, @"GDataXMLNode sees an unexpected empty string");
#endif
if (chars == NULL) return nil;

  CFMutableDictionaryRef cacheDict = NULL;

  NSString *result = nil;

  if (xmlNode_ != NULL
    && (xmlNode_->type == XML_ELEMENT_NODE
        || xmlNode_->type == XML_ATTRIBUTE_NODE
        || xmlNode_->type == XML_TEXT_NODE)) {
    // there is no xmlDocPtr in XML_NAMESPACE_DECL nodes,
    // so we can't cache the text of those

    // look for a strings cache in the document
    //
    // the cache is in the document's user-defined _private field

    if (xmlNode_->doc != NULL) {

      cacheDict = xmlNode_->doc->_private;

      if (cacheDict) {

        // this document has a strings cache
        result = (__bridge_transfer NSString *) CFDictionaryGetValue(cacheDict, chars);
        if (result) {
          // we found the xmlChar string in the cache; return the previously
          // allocated NSString, rather than allocate a new one
          return result;
        }
      }
    }
  }

  // allocate a new NSString for this xmlChar*
  result = [NSString stringWithUTF8String:(const char *) chars];
  if (cacheDict) {
    // save the string in the document's string cache
    CFDictionarySetValue(cacheDict, chars, (__bridge_retained const void *) result);
  }

  return result;
}

And if you refer back to the trace stack, it is this line in the above function that appears to be causing a problem (see trace stack line #8):

      result = [NSString stringWithUTF8String:(const char *) chars];