After reading through the release notes of Mendix 7.2 i saw the following known issue:
Known issue
Changes for reference set members that are read-only for the user are not correctly serialized from the server to the client (browser). This can lead to an IllegalArgumentException with this message: “Global identifier should be a number.”
So it seems your reference set being User.UserRoles is causing this error because the role is set server side. Perhaps you fix this by not setting the role server side (for the time being).
Edit: After looking in to this more carefully this bug is pretty pesky in combination with the UserRoles association. Is there any eta on when this bug will be solved?