ramones is right - the 'destroy' action actually means 'flag this instance to be destroyed at the end of the next top-level event', because for various reasons the engine cannot truly destroy an object halfway through an event. So the objects will continue to exist and be looped over after a destroy action in a subevent. Does that explain your problem?
A workaround could be to set a 'destroyed' instance variable on the object, and when destroying an instance also set 'destroyed' to true. Then only loop over objects where 'destroyed' is false.