According to Daniel, Passenger seems to crash whenever he tries to access one of the applications, but only if he accesses from iPhone, and only when the server is serving a pair of video files. This might be some kind of race condition caused by network latency.
I've been able to reproduce the issue by serving two large Rack responses at the same time to clients that don't read the response body. Here's what the server looks like:
kb = "x" * 1024
(80 * 1024).times do
eio_write() passes the I/O request to a thread before returning. This thread might finish (and call the callback) before the moveContext->req = assignment finishes. The callback tries to use moveContext->req, observes a NULL pointer and crashes.
We need to find a way to start an I/O request without dispatching it to a thread yet.