This is not a cocos bug, it's a side-effect of a design choice. When you create a CallFunc* action, the target passed as a parameter is retained. If that target was not retained (and if I remember correctly, it was the case in early cocos releases), you could have ended up with your application crashing if the CallFunc target had been deallocated between the moment the CallFunc action was created and the moment the CallFunc callback was triggered. The point is, the target is retained. Since the target is self in your case, then self is retained by one of its ivar (action). As shazbox said, you need to release your action manually when you think your class is about to get dealloc'd. If your class has the same lifetime as its top-parent Scene, then you could release the action in the onExit method.
Or you could create a "proxy" class for CallFunc callbacks. This "CallFuncProxy" class would have a weak reference to your current class. And when you create your action in your init method, instead of passing self as the target, you would pass an instance of the proxy class. When the CallFunc callback is triggered, the proxy class immediately calls the appropriate selector on your current class. This way, the proxy class gets retained instead of your class, thus dealloc gets called. And in dealloc your action gets released, which causes the proxy class to get released too.
