The user object was triggering the creation of a user context that tried to grab something from the session. The later code never tried to use this due to the checkPerm flag.
I'm assuming the user model used to have a sane constructor w/o side effects in the times where this code had it's heyday.