Long shot, but could a script be overwriting the toolbar file? Maybe something that was set up to swap between different toolbars sometimes?
Or any kind of sync or backup tools monitoring the Buttons folder?
Something to check:
- Go to the folder the toolbar is in
- Reset the toolbar
- Verify the date/time changed
- Make a copy of the toolbar
Then open a new window, and see if the date/time or size/content have changed again.
If changed again as a result of opening the new window, and there's no clear reason, repeating those steps while recording a ProcessMonitor log might be the best way to find out what's modifying the file.