NSInvocation va_arg crash explanation

gistfile1.m

// clang -o test test.m -framework Foundation

#import <Foundation/Foundation.h>

@interface Forwarder : NSObject {
@package;
	id destination;
}
@end

@implementation Forwarder

- (NSMethodSignature *)methodSignatureForSelector:(SEL)aSelector {
	return [destination methodSignatureForSelector:aSelector];
}

- (void)forwardInvocation:(NSInvocation *)anInvocation {
	NSLog(@"forwarding %tu arguments with frame length of %tu", [[anInvocation methodSignature] numberOfArguments], [[anInvocation methodSignature] frameLength]);
	[anInvocation setTarget:destination];
	[anInvocation invoke];
}

@end

@interface Destination : NSObject
- (void)logWithFormat:(id)format, ...;
@end

@implementation Destination
- (void)logWithFormat:(id)format, ... {
	va_list ap;
	va_start(ap, format);
	NSString *string = [[[NSString alloc] initWithFormat:format arguments:ap] autorelease];
	va_end(ap);
	NSLog(@"%@", string);
}

@end

int main() {
	// it seems that the va arg stuff works through NSInvocation up until a point
	// only by luck that the invocation thinks the frame is a bit bigger than it really is.
	NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
	Destination *destination = [[Destination alloc] init];
	Forwarder *forwarder = [Forwarder alloc];
	forwarder->destination = destination;
	[(id)forwarder logWithFormat:@"3 args"];
	[(id)forwarder logWithFormat:@"%@", @"4 args"];
	[(id)forwarder logWithFormat:@"%@%@%@", @"", @"", @"5 args"];
	[(id)forwarder logWithFormat:@"%@%@%@%@", @"", @"", @"", @"6 args"]; // crashes here
	[destination release];
	[forwarder release];
	[pool release];
}