Doctrine entities are sometimes wrapped in Proxy objects, and the instantiateObject method does not handle them transparently.

For example, an entity MyBundle\Entity\User might have a class name of Proxies\__CG__\MyBundle\Entity\User. When this occurs, the instantiateObject method does not detect that it is in fact the same entity, and attempts to create a new one.

The Security component uses ClassUtils::getRealClass() to get around this issue.

I believe the issue is with the following line of code:
https://github.com/symfony/symfony/blob/master/src/Symfony/Component/Serializer/Normalizer/AbstractNormalizer.php#L250