In mod/assignment/type/online/assignment.class.php, line 109, there's the following line:

$text = file_rewrite_pluginfile_urls($submission->data1, 'pluginfile.php', $this->context->id, 'assignment_online_submission', $this->assignment->id);

which seems to indicate that the assignment id is being used as the item id - shouldn't be this the user id, since the context id already includes the id of the assignment?