As the summary says. See attachement.
Created attachment 448 [details]
Apple debug info
The problem is this line in tlclient:
If it is commented out, the crash disappears. One would think that that function is used for disposing an AEDesc, but apparently, it is used for disposing other objects as well, including AppleEvent:s. And as usual, the reference documentation for AEDisposeDesc is missing...
Fixed in 25632.
termVNC rewritten in 25633.
Tested with client build 3668 on Mac OSX 10.8.1 and no crashes occurs