There's this FIXME in the code:
# FIXME: We have a very small window for a race condition here, i.e. if
# start_byte happens to be in the middle of either a _CONNECT_STRING
# or a _DISCONNECT_STRING. We could seek back to the beginning of
# the line before parsing in order to close this window, but
# unfortunately this open up another window - two parse_log calls on
# the same line containing a _CONNECT_STRING or a _DISCONNECT_STRING.
# There is probably a solution to this, however the window is so
# small that it's not worth spending time on right now.
Unfortunately it seems it happens in practice now in issue 15241.
The code also has a race between stat():ing the file and actually reading it.
The proper solution is probably to keep the file open and do blocking reads on it. That would also get rid of the polling timer and make it properly event driven.
Verified that the issue can be reproduced using following commands with ThinLinc 4.2.0, eg. no notification popup is show;
echo -n "tl-shadow-notify: OpenAuthenticatedConnectio" >> xinit.log
echo "n" >> xinit.log
and same test with ThinLinc build 4509 works as expected.