Fix segfault from overaggressive CFRelease()