In Kubuntu 12.10 using KDE 4.9.3, switching users from user X to user Y shows Y's screen before Y's password has been entered. Looks like the same sort of security flaw that plagued the old KDE screen locker before it was moved to the compositor.

Is there a bug report for this?

The screen locker has changed mechanism in 4.10. Before opening a bug report, it may be worth checking (perhaps with a VM or a LiveCD) whether this behavior occurs in 4.10 as well.

It occurred when I upgraded to 4.10 RC3. But it happens only on my Intel 945GM system, and not on the system I have using fglrx, the proprietary Radeon blobs (which is also much faster than the old Intel system). Still a bug in my opinion.

A recent commit may have fixed it, if I read development lists correctly. Can you try with 4.10 final once it's out?

EDIT: I had quick exchange on IRC with Aaron Seigo and he implies it may be a driver related issue. In case 4.10 will not fix your issue, 4.11 likely will due to some architectural changes (locking before switching).

Just wondering, is the Intel 945GM system using compositing?

Yes, it's using compositing. But the problem is there also without compositing (for both users).

Are you using any screen saver, or just simple screen blanking?
Also, please make sure to try KDE 4.10 if possible.

No screensaver. All of this happening under 4.10 RC3. I'll have to update to final to check whether it's still happening.

I suspect this will be a timing issue, based on it working on a fglrx system but not on the Intel 945GM system.
In this case, a bug report could definitely be worthwhile, as the implementation may need further hardening. Please make sure you are using KDE 4.10 final however, just to ensure that no last minute fixes corrected this issue.

As I said earlier, the Plasma developers are aware of this issue. The correct solution will need to land in for 4.11, though.