Passing a "substring" function projection to the left side of an IN restriction causes duplicate parameters in the generated DB command, which in turn causes parameter type conversion exceptions in the DB.
This issue has been described in more detail the following places. Unfortunately it doesn't appear to have been fixed in 3.2.0.GA despite some of these articles suggesting it was addressed in 3.0.0.GA.
I've attached a unit test that replicates the issue. It reliably shows too many ICriteriaQuery.CollectedParameters after calling InExpression.ToSqlString.