If you call a synthesized setter in dealloc, you get a fault. The synthesized setter wants to sync, the object's "isa" has already been restored to pre-faux-lock-object-subclass; therefore, sync.m attempts to re-subclass-swizzle which fails at some assert within the runtime (I don't have the runtime built with debug).
Clearly, if it were to succeed, bad things would happen.
OK, didn't look at SVN. We seem to have a better approach, though looks like we can never clean up locks.
Thought: we should still be able to swizzle 'dealloc', no? We just need to steal the dealloc of any object hierarchy root?