I think I found the problem. I think it was nothing to do with NAT SIPping. I had to patch ip_addr.h because Clang on FreeBSD was not finding the INADDR_LOCALHOST definition from netinet/in.h, despite it being there in FreeBSDs' /usr/include. So previously I defined it as an 'unsigned long'. Now that I have defined it in ip_addr.h as a 'u_int32_t' Kamailio has not crashed since. Also, I no longer get any errors in my /var/log/messages when Linphone closes.
I have yet to re-enable WITH_NATSIPPING, I want to wait a bit longer before drawing any further conclussions.
Thanks and regards to all the Kamailio devs, Euan Thoms.