We just wrapped up a project that made use of Multistep and CCK to create a form. We came across a bug in this state:

- The CCK form item in question is a node reference, using a text autocomplete widget
- The allowed items for the field was set to "unlimited", so the resulting UI has two fields, plus the "Add Another" button
- Multistep was enabled on the Content type
- If a user's role did NOT have access to the "view full form" button

The bug was that if you clicked the mentioned "Add Another" button, the entire CCK field is removed from the DOM. Poof - gone. When the page is reloaded, the field returns.

The fix that we found was to enable the "View Full Form" option for all roles in permissions. The form then worked as expected for all roles. The issue, then, really is if you don't want to enable that for any reason (such as keeping the UX simple).