All we know is that it triggers on the string "user"; could be that it CRCs to "00000000" or some other magic value, which then actually triggers the bug - and

All we know is that it triggers on the string "user"; could be that it CRCs to "00000000" or some other magic value, which then actually triggers the bug - and that there are other strings that could do this. (Which doesn't make your explanation implausible - per Occam's razor, yours would require fewer extra entities, and thus looks more likely - just that we don't know for sure)