Today I stumbled across this KB article: “In SharePoint 2007 using Internet Explorer 8 and "Sign in as a different user" displays with old Session data. After 30 seconds the session object is completly refreshed and all data is correct.”

Hmm. Right. I’ve noticed that. At least now I know that this is by design

Take a look at the suggested workarounds: http://support.microsoft.com/default.aspx?scid=kb;en-us;2435214&sd=rss&spid=11373

Workaround 1: customize init.js file or overload the method of LoginAsAnother() with an addition line of code: document.execCommand("ClearAuthenticationCache");

Workaround 2: change IIS authentication behavior to force the authentication for each incoming http request

Workaround 3: create a custom httpmodule and deploy it over the farm (all webapplications)