We have a VF page that overrides the tab for a custom object. This page can be viewed in 2 modes: 1) without parameters in url, 2) with parameters in url. Both modes can be accessed fine by AdminUser1, but AdminUser2 can only access the page without parameters. Once she puts in *any* parameter she gets an "Insufficient privileges" error.

I tried removing everything from the VF page (actually reduced to 2 lines) but the behaviour didn't change. In the controller for the page there's zero logic around the parameter that's being passed. Moreover, like I said, this error occurs with *any* parameter even if it's some garbage character.

Any ideas what's going on?!