To close this out, I'll restate what I did in my comment above:
Generally, when I've encountered odd OpenGL ES crashes like this that suddenly appear on one class of device or another, I always check for simultaneous accesses to the same OpenGL ES context. If you access a given OpenGL ES context from multiple threads at the same time, bad things will happen, including crashes like this.
My preferred way of handling this is to wrap accesses to a given OpenGL ES context in blocks on a GCD serial dispatch queue. That guarantees safe access to the context without the overhead of locks. It's also pretty easy to implement in your code.