One additional comment to add:

When I change the if() conditions to:

$user_sub_resource === true

for each reference to $user_sub_resource then the error goes away.

The problem also goes away if I change the line AFTER the problem to:

if ($action === 'get_securityquestions' && !$this->isRequestor($user_id))

Though I have absolutely no idea why that is the case.

I can reproduce with the following code:

<?php error_reporting(E_ALL);

function test($r, $action) {
    $user_sub_resource = in_array($action, array('get_securityquestions', 'get_status', 'get_groupstats'));

    $user_id = null;
    if ($user_sub_resource && isset($r['user_id'])) {
        $user_id = $r['user_id'];
    }
    else if (isset($r['id']))  {
        $user_id = $r['id'];
    }

    if ($user_sub_resource) {
        return 'foo';
    }

    return 'bar';
}

var_dump(test(['user_id' => 1, 'id' => 2], 'foo'));

In the DFA pass we end up going from

            #6.T4 [bool] = IN_ARRAY 0 #5.CV1($action) [any] array(...)
            ASSIGN #2.CV2($user_sub_resource) NOVAL [undef] -> #7.CV2($user_sub_resource) [bool] #6.T4 [bool]
            NOP
            JMPZ #7.CV2($user_sub_resource) [bool] BB3

to

            #7.CV2($user_sub_resource) [bool] = IN_ARRAY 0 #5.CV1($action) [any] array(...)
            JMPZ #7.CV2($user_sub_resource) [bool] BB3

which drops the NOP necessary for smart branch inhibition.

The issue seems to be that the NOP elimination only checks for the pattern smart-branch-op NOP JMPZ/NZ, however in this case there will be two NOPs between the IN_ARRAY and the JMPZ, which is not detected as a smart branch.