There is a bug when you create a transaction with admin/store/transaction/create
If the liste of product Ids ends with a comma, there is a mysql error.
You can also add Ids of nodes that are not products.
I think there should be the same verification in store_transaction_validate_item (store.inc) as in store_transaction_add_items_form_validate (store.module), that is to say something like :

foreach (split(', ?', $edit['nids']) as $nid) {
if (!is_numeric($nid) || !db_result(db_query("SELECT nid FROM {ec_product} WHERE nid = %d", $nid))) {
form_set_error('nids', t('Invalid list of product IDs'));
break;
}
}