We include mail.thread in our module and you only have the rights to see your own res.partner object. So if someone rights a comment it gets a security exception on try to read the name of the follower.
I know on odoo.com/web this is fix. Maybe some hint where to find the patch.
