The analyzer crashes when the user tries to allocate stack memory through alloca() and then construct an Objective-C object in it. The alloca() function is handled in the analyzer by its own concrete untyped memory region, AllocaRegion, which doesn't contain any clues on what type it might carry (because there are none). getDynamicTypeInfo() therefore ignores it unless a specific type info is already available.
To think: maybe we could pickup some dynamic type info from the implicit cast. We don't always have an implicit cast though.