[MunkDev]

I figured out a workaround, which involves scanning the children of UIParent outside the secure environment and then pushing the frames onto a stack one by one if they are protected.

Attempting to insert something tainted into a table created in the secure environment is most likely what caused the problem. Since InterfaceOptionsFrame is a child of UIParent, it would be included in the table if the scan is done outside of combat. Why specifically Bagnon seemed to be the culprit, I'm not sure. But this solution works:

function ConsolePort:UpdateSecureFrameStack()
    if not InCombatLockdown() then
        for i, child in pairs({UIParent:GetChildren()}) do
            if not child:IsForbidden() and child:IsProtected() then
                UIHandle:SetFrameRef("NewChild", child)
                UIHandle:Execute([[
                    FrameStack[self:GetFrameRef("NewChild")] = true
                ]])
            end
        end
    end
end

-- Changed this to only scan a predefined table instead of creating a new one
UIHandle:Execute([[
    UpdateFrameStack = [=[
        Nodes = wipe(Nodes)
        for Frame in pairs(FrameStack) do
            CurrentNode = Frame
            self:Run(GetNodes)
        end
    ]=]
]])