We have seen this kind of issue in our deployment since we upgraded to 5.0. It seems to me to be related to profiles because it only happens to some profiles, not some users. And often it helps to edit the profile and submit it.
I would really like to know if anyone has a found a way to fix this, or if this is someting Cisco is working on