I may be going out on a limb here, Matthew, but just in case: Is it possible the person who populates the container field is inserting content as a reference? This should account for it, especially if the file being inserted as a reference is located where only (Active Directory) users that share privileges with the [full access] FileMaker user have access to the file or its location, while others do not have such access.
I thought I had controlled for that in the script. I'll double-check when I'm at the client site early next week. Probably they're adding the files in a way that I didn't anticipate.
Yup. Simple oversight. One checkbox in the script step. <sound of palm against forehead>