I think this is because xscreensaver confines (grabs) the mouse cursor to the area occupied by the "Please enter your password" window. If this area somehow suddenly happens to be out of your screen boundaries (e.g. when xrandr --offing external screens), the mouse is ungrabbed and can be used to interact with the desktop. It takes a while before xscreensaver notices and grabs it again. Someone should probably figure out the exact steps to reproduce this and report it.

As said elsewhere, locking X is really hard, and xscreensaver architecture doesn't help. This week I managed to crash xscreensaver login prompt twice, unlocking the desktop without entering my password, and that was the last straw, I switched to xsecurelock which separates the login entry into another process, making such bugs much less severe.

Unfortunately I can't reliably reproduce the crash. A hardware fuzzer (also known as a faulty ThinkPad keyboard) was involved, and I don't possess the device any more. I think what it did was press certain keys very often ­— the keyboard matrix is sampled at 125 Hz, so I'm guessing it was pressing the keys about 60 times per second, but I'm not sure which keys they were. If anyone manages to reproduce this, please do give me a shout. :-)