I finally figured it out.
Many moons ago we had added a call to ec_create_new_session_if_necessary to user-new-2.tcl, so that if a user had already shopped and had stuff in their cart, then created a user, it would allow them to keep their cart. This worked, I suppose (it's been so long I have forgotten the exact reason and I'm not even sure I was the one who put it in) but in some circumstances it ended up returning the user back to the caller, which in this case was user-new-2. Of course it did not pass the expected form along and so this error was the result.
Now that I see what's happening the only mystery is why it happens to only a few users and not everyone, but that's a question for another day. :)
