Unfortunately, I do not have any real details on reproducing this. I have seen some intermittent crashes on the unit tests for iOS - and it seems to be around use of Ti.UI.TabGroup. It looks like it has some issues when the window/controllers it has attached are getting deallocated while the tab group is not.
One of the attached crash logs is really referring to this line:
https://github.com/appcelerator/titanium_mobile/blob/master/iphone/Classes/TiUITabProxy.m#L799
Presumably the window proxy got GC'd/deallocated while the tab did not.
The other case seems to be around a tab trying to dealloc a window that may have already had some portion of itself dealloc'd?
[~cwilliams], are you still seeing those in recent Jenkins builds?