I'm wondering on how I can debug this. What I do know, is that there is no memory leak, other than that from within the framework which is bounded (hence not the reason), and I can see that the crash is not occurring in the heatbugs code (based on the traceback). All I have is this...
#0 0x92ea1917 in objc_msgSend
#1 0x2b55e080 in ??
#2 0x94241946 in -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:]
#3 0x9423fe9e in -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:]
#4 0x94240e13 in -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:]
#5 0x94240e13 in -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:]
#6 0x9423fa13 in -[NSThemeFrame _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:]
#7 0x9423c359 in -[NSView _displayRectIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:]
#8 0x9419cf26 in -[NSView displayIfNeeded]
#9 0x94166292 in -[NSWindow displayIfNeeded]
#10 0x94197764 in _handleWindowNeedsDisplay
#11 0x91249b02 in __CFRunLoopDoObservers
#12 0x9120665d in __CFRunLoopRun
#13 0x91205d34 in CFRunLoopRunSpecific
#14 0x91205b61 in CFRunLoopRunInMode
#15 0x92423fec in RunCurrentEventLoopInMode
#16 0x92423da3 in ReceiveNextEventCommon
#17 0x92423c28 in BlockUntilNextEventMatchingListInMode
#18 0x9416dc95 in _DPSNextEvent
#19 0x9416d50a in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
#20 0x9412f69b in -[NSApplication run]
#21 0x94127735 in NSApplicationMain
#22 0x00003201 in main at main.m:23
...so seems related to the view - but where?
Note that it does not always crash and sometimes goes for ever - I also tried the UI's 'Sudden Termination' - didn't reveal anything terribly useful.