It's probably an automated script on the server, and a dumb one at that. I imagine it's something like this: a rudimentary process monitoring tool on the server looks for scripts that are generating high load. It kills the script and appends '_disable' to the name.
What's dumb about it is exactly what we've seen here. With indexes enabled in Apache, we can see the vhost's underwear. Not good.