Drupal 7 "The form has become outdated. Copy any unsaved work in the form below and then reload this page."
The reason you get the "The form has become outdated." error is because the token fails validation (meaning the old string doesn't match the new string). The token is determined by running a hash on several things including the session_id(). When you call user_save(), the session is changed/invalidated/whatever. Hence, when the token is tested next time around, it generates a different token because you have a different session_id() and therefore fails, thinking you were using an old form.

I have the same issue after calling user_save() from within my form processing. The way I fixed it feels like a pretty big hack, but I don't know that there's a clean way around it. The form code doesn't seem to expect that you would ever change/invalidate the session whilst in the middle of handling a form (in this case, a multi-part form).

Once you call user_save you must modify the form state manually to insert the updated token. Then, when it checks tokens your new token will match since you generated it after the 'session_id()' was updated.

So the resulting code looks like this. Notice that the input element is changed for $form_state to pass by reference so that the modification gets propagated up.

function _upload_users_phone($form, &amp;$form_state, $operation, $returns) {
  global $user;
  // load user

  $existingUser = user_load($user-&gt;uid);

  if($operation == 'add') {
    $existingUser-&gt;field_user_phone['und'][]['value'] = $form_state['values']['phone']['prefix'] . ' ' . $form_state['values']['phone']['number'];
    $user = user_save((object) array('uid'=&gt;$user-&gt;uid), (array) $existingUser);
    $form_state['input']['form_token'] = drupal_get_token($form['#token']);
  }
    // edit field-data
  foreach ($existingUser-&gt;field_user_phone['und'] as $key =&gt; $value) {
    $val_list[] = $value['value'];
    $key_list[] = $key;
  }

  return $val_list;
}


You might also need to set $form_state['values']['form_token'], but I'm pretty sure it's unnecessary. Again, don't forget the &amp; in front of the declaration of the function variable $form_state or the value won't make it into the real array.