There are 2 bugs here. The first one is due to one of our patches to implement a different session dialog, which will cause gnome-session to crash if shutdown is not available. In particular, this bit of gnome-session/gsm-logout-dialog.c:

        switch (logout_dialog->priv->default_response) {
        case GSM_LOGOUT_RESPONSE_LOGOUT:
                info_text = ngettext ("You will be automatically logged "
                                      "out in %d second.",
                                      "You will be automatically logged "
                                      "out in %d seconds.",
                                      seconds);
                break;

        case GSM_LOGOUT_RESPONSE_SHUTDOWN:
                info_text = ngettext ("This system will be automatically "
                                      "shut down in %d second.",
                                      "This system will be automatically "
                                      "shut down in %d seconds.",
                                      seconds);
                break;

        case GTK_RESPONSE_CANCEL:
                info_text = _("You are currently logged in as \"%s\".\n"); ****GOES WRONG HERE****
                break;

        default:
                g_assert_not_reached ();
        }
        
        if (session_type == NULL) {
		GsmConsolekit *consolekit;

                consolekit = gsm_get_consolekit ();
                session_type = gsm_consolekit_get_current_session_type (consolekit);
                g_object_unref (consolekit);
        }
        
        if (g_strcmp0 (session_type, GSM_CONSOLEKIT_SESSION_TYPE_LOGIN_WINDOW) != 0) {
                char *name, *buf, *buf2;
                name = g_locale_to_utf8 (g_get_real_name (), -1, NULL, NULL, NULL);

                if (!name || name[0] == '\0' || strcmp (name, "Unknown") == 0) {
                   name = g_locale_to_utf8 (g_get_user_name (), -1 , NULL, NULL, NULL);
                }
        
                if (!name) {
                        name = g_strdup (g_get_user_name ());
                }

                buf = g_strdup_printf (_("You are currently logged in as \"%s\"."), name);
                buf2 = g_strdup_printf (info_text, seconds); ****CRASHES HERE****
                markup = g_markup_printf_escaped ("<i>%s</i>", g_strconcat (buf, "\n", buf2, NULL));
                g_free (buf);
                g_free (buf2);
                g_free (name);

I think that looks like the first bug.

The default_response is earlier set to GTK_RESPONSE_CANCEL (when it would normally be GTK_RESPONSE_SHUTDOWN) because this fails:

                if (!gsm_logout_supports_shutdown (logout_dialog)) {
                        gtk_widget_set_sensitive (tile, FALSE);
                        /* If shutdown is not available, let's just fallback
                         * on cancel as the default action. We could fallback
                         * on reboot first, then suspend and then hibernate
                         * but it's not that useful, really */
                        logout_dialog->priv->default_response = GTK_RESPONSE_CANCEL;
                }

The reason for this is because in gsm_consolekit_can_stop, it calls org.freedesktop.Consolekit.Manager.CanStop, which returns with a permissions error, and that looks like the second bug.