signup_form_data not always an array?

Over in the patch for http://drupal.org/node/154580, killes included the following change:

-    $signup_form_data = serialize(array_merge($signup_form['signup_form_data'], $extra));
+    $signup_form_data = serialize(array_merge((array) $signup_form['signup_form_data'], $extra));

Apparently, sometimes $signup_form['signup_form_data'] isn't really an array. If that's true:

A) This needs more investigation into the causes and probably needs a better solution than just a cast.
B) This is a bug that's present in all versions and needs to be backported.

So, I'm submitting this as a separate issue so it can be dealt with independently of the event 5.2 porting and other refactoring going on at #154580.