If your controller is dealing with strings because the crop data is coming in via an ajax GET, it might be worth trying to make them into integers before applying the crop. Example from my terminal...
Trinity:~ kelvin$ python
Python 2.5.2 (r252:60911, Feb 22 2008, 07:57:53)
[GCC 4.0.1 (Apple Computer, Inc. build 5363)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> from PIL import Image
>>> f = open("happy.jpg")
>>> im = Image.open(f)
>>> box = (0,0,100,100)
>>> kay = im.crop(box)
>>> kay
<PIL.Image._ImageCrop instance at 0xb1ea80>
>>> bad_box = ("0","0","100","100")
>>> nkay = im.crop(bad_box)
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/PIL/Image.py", line 742, in crop
return _ImageCrop(self, box)
File "/Library/Frameworks/Python.framework/Versions/2.5/lib/python2.5/site-packages/PIL/Image.py", line 1657, in __init__
self.size = x1-x0, y1-y0
TypeError: unsupported operand type(s) for -: 'str' and 'str'
>>>