Here's another one:
(setq debug-on-error t)
M-x M-x
It enters debugger.
Also:
M-x C-x o M-x
It enters debugger.

The attached patch fixes it in both cases. It also applies to trunk; just ignore the hunk for undo.c (user_error is already deleted from undo.c in trunk, but the hunk is needed for 24.3 to prevent a compiler error).

Also, in primitive-undo in simple.el in trunk, the 4 occurrences of
(error "Changes to be undone are outside visible portion of buffer")
might be a regression; primitive-undo in undo.c in 24.3 uses user_error in all 4 cases. But I haven't checked to make sure; maybe they really are program errors, not user errors.

Also, between 24.3 and trunk, bitch_at_user in dispnew.c changed from using the error function to manually signalling a user error. It should just use user_error, which does the same thing.