I don't think the second snippet would be fixed by writing
NSString *ns = (__bridge_transfer NSString *)CFBridgingRelease(string);
because as far as I know, __bridge_transfer is basically the same as CFBridgingRelease. The problem with the second snippet is that when the local variable ns goes out of scope, the string will be released, but the local variable string is not set to nil, hence CFRelease will be passed a bad pointer.