Well, i can't reproduce this on a few testing virtual machines, but i think there were a few issues with vcard popups. Maybe some of them are fixed in 2.9.0. I would ask to try latest 2.9.0 build, but currently it won't work with self-signed certificates, unless you disable SSL on the server and in the client. This might also be related to big images set as avatars. 2.9.0 should restrict that too. Current workaround would be to disable vcard popups i guess.