Final Edit:

I found the solution to my problem, maybe it will solve yours too. (Look at my answer to this question:) UIButton, created by Interface Builder, is crashing

Specifically, if your buttons have any images, try deleting them from your project, getting fresh copies, renaming them, re-adding them to the project and then hooking them up again. Seems to have worked in my case.

---

Previous randomness from me:

(Not an answer, but...) For what it's worth, I'm getting a similar message. Maybe adding what I'm seeing might help figure this all out. I get this both in the Simulator and on the device.

-[UIImage isKindOfClass:]: message sent to deallocated instance 0x1661f0

This message is not always identical for me, sometimes its about retaining an invalid instance, or a few other similar sorts of things. None of these are things I'm doing myself, but behind the scenes stuff.

EDIT: Here's another one:

-[UIImage retain]: message sent to deallocated instance 0x3b621a0

Here's the code where I'm getting dumped (like you, I'm showing a modal dialog, though mine's a custom UIView). In my case, I'm forcing the run loop to wait for a user response like this:

[modalDialog showInView:self.view
                  title:@"Illegal Move"
                message:message 
             cancelText:@"Cancel" 
            proceedText:@"Cheat"];

while (waitingForDialogToDismiss == YES) {
    //this line is where NSZombies puts me:
    [[NSRunLoop currentRunLoop] runMode: NSDefaultRunLoopMode 
                             beforeDate: [NSDate dateWithTimeIntervalSinceNow:1.5]];
}

This modal dialog is built completely from a nib, and has a couple button images and shows correctly almost always. However, if I try to "rush it" by tapping many different UI elements before it comes up, I can get this error about 30-40% of the time. On one occasion, even though the dialog showed up, its Cancel button had the wrong graphic.

It almost seems like the showing of the view isn't always completely loading everything correctly, or maybe in a timely manner.

For the moment, I'm going to try rewriting a bunch of code to remove the NSRunLoop business. We'll see.

EDIT 2: No help

The NSRunLoop was definitely not the problem. I've narrowed it down much more and started a new question here: UIButton, created by Interface Builder, is crashing