NMRemoteSettings needs to asynchronously initialize a connection object after it's constructed, and it assumes its own instance is still valid in the initialization callback, without taking a self-reference. It's entirely possible that the library client gets rid of the last reference to the NMRemoteSettings before the callback returns; this will cause the callback to access invalid memory and crash.