As the summary says. See attachement.
Created attachment 448 [details] Apple debug info
The problem is this line in tlclient: AEDisposeDesc(&focusVNCViewer); If it is commented out, the crash disappears. One would think that that function is used for disposing an AEDesc, but apparently, it is used for disposing other objects as well, including AppleEvent:s. And as usual, the reference documentation for AEDisposeDesc is missing...
Fixed in 25632.
termVNC rewritten in 25633.
Tested with client build 3668 on Mac OSX 10.8.1 and no crashes occurs at logout.