krb5-auth-dialog, if installed, will autostart on every login and does not prevent itself from being run multiple times. It is also saved in the session store, so an additional copy is run every time the session is reloaded. Could it possibly be excluded from the session store by default?
And, duh, the fix is to just call krb5-auth-dialog with --sm-disable, which was done in krb5-auth-dialog-0.7-5 but unfortunately that version was never propagated down to F7.