While using a debugger in Confluence (the use of the debugger is probably what exposed an unlikely race condition), I found that DefaultPersonalInformationManager.getOrCreatePersonalInformation() is not atomic as its comment claims, probably because there's no synchronisation on it. The result was two user information objects created, with the user appearing twice in the people directory and the following error in the logs:

2009-08-27 15:04:24,630 ERROR [http-1990-Processor14] [com.atlassian.hibernate.HibernateObjectDao] findSingleObject 
Uh oh - found more than one object when single object requested: [userinfo: three v.1 (2064387), userinfo: three v.1 (2064388)]
 -- referer: http://localhost:1990/wiki/browsepeople.action?startIndex=0 | 
url: /wiki/display/~three | userName: testadmin | action: viewuserprofile

This issue may cause future problems in Studio, which has subscriptions from Crowd to notify it when new users are created, and uses the createPersonalInformation() method to put that user in the people directory. I have no idea how this was called concurrently a second time by a different thread (maybe by the indexer in the background before the transaction was committed?) but what is certain is that there ended up being two personal information objects.