Fatal exception (28):
epc1=0x402411a9, epc2=0x00000000, epc3=0x00000000, excvaddr=0x000000aa, depc=0x00000000
ets Jan 8 2013,rst cause:4, boot mode:(3,7)
wdt reset
After a liberal sprinkling of printfs, it appears to be WDT resetting after a call to wifi_station_get_connect_status() in both wifiStartScan (when scanning is run) and resetTimerCb (when I bypass scanning).
Furthermore, I think you might be missing a call to os_timer_arm on reassTimer in the cgiWiFiConnect function... the default version never rearms the timer so it just sits there in AP mode.
Thoughts?