Hallo Mike,
Strange that you can't reproduce the problem. I think that your test should have the same result.
I'll describe what happened:
We have built an intranetsite for our client with DNN 4.6.2 and AD provider 1.00.00. The site has a 'facebook'. We use de module Dynamic User Directory to generate the facebook. The data (name, path to photo, etc) of the facebook is stored in profile fields. We added a view custom profile fields like photo.
The client had some performanceproblems. So we setup a testserver and discovered that most of the problems went away after upgrading the latest AD provider.
We then installed the new AD provider on the real intranetsite. Everything seemed to work ok. But the next day somebody mentioned to us that a lot of the photo's of the employees had turned into a smiley. The default value of the photo field was a link to the smiley.
So I thought that the AD provider was setting the photo field value to the default value when someone logs in. We removed the default and the problem seemed to disapear.
Maybe the bug only happens with custom fields? You tested it with city. That's one of the standard profile fields of DNN.
I have no access to the (test) server at the client at this moment. But I could do some tests next week.