To reproduce try to edit a calendar name in the kronolith app. The request will include the sid in the "name" field instead of the actual calendar name.
This was indroduced in this commit: 52245da
Ajax requests using the doAction method will always have the "name" param set to the sid if an sid is defined.
See also the addRequestParams and sessionId functions in hordecore.js
This would have to be fixed by removing this sid completely (if it is not needed anymore) or changing the name of the field to something other than "name" that is more likely to be unique.