I think I've found a bug in the CallFunc action. When you create a CallFunc action, you pass a target which the action retains. This is a problem if the target also retains the action.
For example, the following line ends up with an object that cannot be released normally:
a = [[CallFunc actionWithTarget: self selector: @selector(doSomething)] retain];
The problem is that the action retains the target object, which in turn retains the action. The dealloc method of the target never gets called...