Ok, I've worked this out.

It happens when the session ID is numeric. PHP changes numeric array indices into integers, so we get it back with an integer and it breaks a query.

This is the chance of it happening:
(10/16)^13*100=0.222%

Oh wow, so I must have gotten lucky XD

Fixed.

sources/users.php in my latest commit

Thanks. Also, is it weird that if a block causes an error, it loads up global_html_wrap again to display the error (and you then get two headers/pages in one)?

Yeah, it can't track output progress really, not really got a solution to that one.