At first I suspected that a change in as_callfunc_arm.cpp might have caused this bug, but you say you're using AS_MAX_PORTABILITY so that can't be the reason.
Does the same problem happen if you compile the library with AS_MAX_PORTABILITY on Windows?
How has the global variable been declared in the script? Is it just a declaration without any specific initialization, e.g. 'UIButton button;'? The bytecode sequence for that would look like this:
0 1 * SUSPEND 1 1 * CALLSYS 31 (UIButton@ _beh_2_()) // call factory function 3 1 * STOREOBJ v1 // store handle in local variable 4 1 * PshVPtr v1 // push the pointer in the variable onto the stack 5 2 * PGA 10833368 // push the address of the global variable on the stack 7 3 * REFCPY 0x3e6f78 // copy the handle to global variable, and increase the reference 9 2 * PopPtr // remove the top pointer from the stack 10 1 * FREE v1, 4091768 // release the handle in the local variable 12 1 * RET 0
Can you add log messages in the AddRef and Release behaviours so we can see if they are called as they should?
Unfortunately I do not have a development environment for Android to test this on, so I'll need your help in figuring out the problem.