CyanogenMod's "deny permission" behavior is largely the same as XPrivacy's, but way less fine-grained (and way easier to use). Basically it just returns "empty" data for requests - it doesn't revoke the permission, because yes, that would cause crashes.

The vast majority of applications work with this with no problems. They just won't e.g. show your contacts.