Orders billing form breaks if Promotion criterion set to 'Require purchase of at least one product in a category'

If I set up a Checkout promo with this criterion included (for any of the
offered promotion types) then the Order module billing form goes to a blank page
after being submitted.

All the other criteria combos seem to work and I've tried specifying other
categories with no success.

Creating this promo from scratch with debug on gives these responses in admin

! ) Warning: explode() expects parameter 2 to be string, array given in
/var/www/html/tpb/modules/Promotions/action.admin_addpromo.php on line 186
Call Stack
#
Time
Memory
Function
Location
1
0.0013
285504
{main}( )
../moduleinterface.php:0
2
0.1538
6098376
CMSModule->DoActionBase( )
../moduleinterface.php:91
3
0.1544
6102952
CGExtensions->DoAction( )
../class.CMSModule.php:1799
4
0.1560
6119872
CMSModule->DoAction( )
../CGExtensions.module.php:694
5
0.1584
6222328
include( '/var/www/html/tpb/modules/Promotions/action.admin_addpromo.php' )
../class.CMSModule.php:1732
6
0.1711
6584624
explode ( )
../action.admin_addpromo.php:186


and

Warning: Invalid argument supplied for foreach() in
/var/www/html/tpb/modules/Promotions/action.admin_addpromo.php on line 187
Call Stack
#
Time
Memory
Function
Location
1
0.0013
285504
{main}( )
../moduleinterface.php:0
2
0.1538
6098376
CMSModule->DoActionBase( )
../moduleinterface.php:91
3
0.1544
6102952
CGExtensions->DoAction( )
../class.CMSModule.php:1799
4
0.1560
6119872
CMSModule->DoAction( )
../CGExtensions.module.php:694
5
0.1584
6222328
include( '/var/www/html/tpb/modules/Promotions/action.admin_addpromo.php' )
../class.CMSModule.php:1732


Here's the (slightly edited) output from the apache error log.

[:error] [pid 13225] 
 Stack trace:, referer: https://xxx.xx.xx/bookshop/checkout
1. {main}() /var/www/html/tpb/index.php:0, referer:
https://xxx.xx.xx/bookshop/checkout
2. Smarty_CMS->fetch() /var/www/html/tpb/index.php:243, referer:
https://xxx.xx.xx/bookshop/checkout
3. Smarty_Internal_TemplateBase->fetch()
/var/www/html/tpb/lib/classes/class.Smarty_CMS.php:341, referer:
https://xxx.xx.xx/bookshop/checkout
4. content_56bb49aa45a700_65041441()
/var/www/html/tpb/lib/smarty/libs/sysplugins/smarty_internal_templatebase.php:182,
referer: https://xxx.xx.xx/bookshop/checkout
5. CMS_Content_Block::smarty_internal_fetch_contentblock()
/var/www/html/tpb/tmp/templates_c/1ed9b7e2d86c34f9dab8c572f920035e590a161e.tpl_body.27.php:60,
referer: https://xxx.xx.xx/bookshop/checkout
6. CMSModule->DoActionBase()
/var/www/html/tpb/lib/classes/class.CMS_Content_Block.php:284, referer:
https://xxx.xx.xx/bookshop/checkout
7. CGExtensions->DoAction()
/var/www/html/tpb/lib/classes/class.CMSModule.php:1799, referer:
https://xxx.xx.xx/bookshop/checkout
8. CMSModule->DoAction()
/var/www/html/tpb/modules/CGExtensions/CGExtensions.module.php:694, referer:
https://xxx.xx.xx/bookshop/checkout
9. include() /var/www/html/tpb/lib/classes/class.CMSModule.php:1732, referer:
https://xxx.xx.xx/bookshop/checkout
10. order_maker->adjust_for_shipping()
/var/www/html/tpb/modules/Orders/action.default.php:140, referer:
https://xxx.xx.xx/bookshop/checkout
11. order_maker->_get_line_items()
/var/www/html/tpb/modules/Orders/lib/class.order_maker.php:517, referer:
https://xxx.xx.xx/bookshop/checkout
12. promotion_tester->find_all_cart_matches()
/var/www/html/tpb/modules/Orders/lib/class.order_maker.php:196, referer:
https://xxx.xx.xx/bookshop/checkout
13. promo_tester->find_cart_match()
/var/www/html/tpb/modules/Promotions/lib/class.promotion_tester.php:280,
referer: https://xxx.xx.xx/bookshop/checkout