Hi TJ,
This issue actually came to my attention recently and is already fixed in the latest code in the source code repository. It will be fixed in the next release.
Basically it is a long standing bug, it has been there a long time but was not very noticeable because for years there were not many differences in the theme.skin file used in different skins included with mojoPortal. But as we added support for Artisteer 2.3 and then 2.4/2.5 and also the new jQueryUI skin, we now have important differences between theme.skin files used in each skin and the problem became more apparent.
What happens is:
In .NET 3.5 Medium Trust, VirtualPathProvider does not work so all skins in all sites use the theme.skin from /App_Themes/default/theme.skin instead of the one in the skin folder.
In .NET 4 VirtualPathProvider does work in Medium Trust and of course it works in Full Trust in both .NEWT 3.5 and 4.0
But there was still a problem until my recent fix because of the way the caching of themes was happening.
ASP.NET really wants and requires all themes (.skin files) to live in the App_Themes folder. What we do with the VirtualPathProvider is we make the runtime think it is getting the theme.skin file from the /App_Themes/default folder but we feed it the file from the skin folder. The problem is that it gets cached based on the path it thinks the file is located at, ie /App_Themes/default/theme.skin. So in a multi site installation what was happening was that the first site to get traffic would end up populating the cache with its theme.skin file and then when the other site requests the same path App_Themes/default/theme.skin it gets the copy that is already in the cache which is from the other site. Again, this would not be noticeable if both sites were using similar skins ie all sites using Artisteer 2.4 skins works fine. But the problem became noticeable if using incompatible themes across sites, like Artisteer 2.3 needs different settings than Artisteer 2.4/2.5, and jQueryUI needs different settings than those and so on.
So, what I had to do was add logic to make each site request a different theme so they get cached separately like /App_Themes/default1/theme.skin, /App_Themes/default2/theme.skin and so on by appending the site id to the requested skin name. Of course this introduced a new problem because those folders don't actually exist, so I had to add some logic in the VirtualPathProvider to fool the runtime into thinking those folders/files do exist.
Anyway, that is the long explanation of the problem and how it went un-noticed for so long.
Best,
Joe