I've done some digging on this to see if it was an easy fix and I can not for the life of me find out where $msg originates...
The closest thing i (my IDE) found was in do_updatecontact.php although i don't feel like it makes any sense. Also the variable is passed on to w2p_Core_BaseObject as a reference. According to method signature and documentation.
In the CContact implementation the signature is:
public function canDelete($msg = '', $oid = null, $joins = null)
Its a bit late here, but doesn't this mean that the value it contains when calling the method doesn't matter since the variable is intended to be used as a return value?
Possibly a related bug that CContact::canDelete does not have the same signature as it's ancestor(?):
public function canDelete(&$msg = '', $oid = null, $joins = null)