Tere's no reference to PrincipalsVocabulary in the code I wrote. I cannot explain why it's in the stack trace. Maybe it's called from dexterity or z3cform for permission checks? I have no idea...
If I use a named vocabulary utility, the widget works fine.