Index: src/OFRunLoop.m
==================================================================
--- src/OFRunLoop.m
+++ src/OFRunLoop.m
@@ -875,10 +875,18 @@
 			 * The handler might have called -[cancelAsyncRequests]
 			 * so that our queue is now empty, in which case we
 			 * should do nothing.
 			 */
 			if (listObject != NULL) {
+				/*
+				 * Make sure we keep the target until after we
+				 * are done removing the object. The reason for
+				 * this is that the target might call
+				 * -[cancelAsyncRequests] in its dealloc.
+				 */
+				[[listObject->object retain] autorelease];
+
 				[queue removeListObject: listObject];
 
 				if ([queue count] == 0) {
 					[_kernelEventObserver
 					    removeObjectForReading: object];
@@ -911,10 +919,18 @@
 			 * The handler might have called -[cancelAsyncRequests]
 			 * so that our queue is now empty, in which case we
 			 * should do nothing.
 			 */
 			if (listObject != NULL) {
+				/*
+				 * Make sure we keep the target until after we
+				 * are done removing the object. The reason for
+				 * this is that the target might call
+				 * -[cancelAsyncRequests] in its dealloc.
+				 */
+				[[listObject->object retain] autorelease];
+
 				[queue removeListObject: listObject];
 
 				if ([queue count] == 0) {
 					[_kernelEventObserver
 					    removeObjectForWriting: object];