Here's the official word from NYSE on last night's 4:15 SPY flash crash:
"On Monday, October 18, the 4 pm ET closing auction in NYSE Arca primary listed symbols was delayed due to an issue with a software release, causing the auction cycle to run at 4:15 pm ET. These auction prices, occurring at 4:15 pm ET, constitute the official exchange closing prices for these issues, with the exception of ‘SPY.’ All trades in the closing auction in ‘SPY,’ which occurred at a price of $106.46, were ruled to be broken by NYSE Arca Market Management. The official closing price will be marked at [4:15 pm] utilizing the valid prior print of $118.28."
I'll point you at the NYSE ARCA Closing Auction page, which claims that closing auctions are single-price Dutch auctions. I could imagine this resulting in a flash crash upwards, but not downwards! I also don't understand how $500M worth of liquidity could have gone through at this price, since this is just supposed to be order-matching. Someone could possibly have known that this were an issue and entered a giant LOC @ 106.46 for 4.5M shares, but that seems unlikely.
Also, if this were really just a simple software error, why didn't they re-run the auction with the submitted bids? My understanding of the process is that these MOC/LOC orders should all be submitted prior to the 4:15 print, which means that the auction could have been replayed with the correct software.
Edit: Here's a document from ITG that explains the closing auction in more detail. Also note that there was no share imbalance reported in SPY yesterday.