From my limited experience with Vbulletin but I think something might be setup wrong of goofy. If you have programmed with vbulletin you will know that it uses a sessionhash and passes it though all the urls as ?s=<32 digit hash> Well this doesn't appear to be happening all the time.
I get this from time to time
http://www.programmingtalk.com/index...sessionhash%5D
Which the html enties translate to %5B = (, %5D = )
so it would seem to me it is trying to pass the sessionhash but something is configured wrong and it passes the entire array.
These hashes are stored in the database and I believed attempted to be stored in a cookie also but not for certain.
Just my 2 cents