Ran across this tip that fixed it for me. Essentially it looks like they forgot to include the formKey in the saveOrder ajax request.
Find app / design / frontend / (template name) / template / checkout / onepage / review / info.phtml
and around line number 60 replace...
<script type="text/javascript">
//<![CDATA[
review = new Review('<?php echo $this->getUrl('checkout/onepage/saveOrder') ?>', '<?php echo $this->getUrl('checkout/onepage/success') ?>', $('checkout-agreements'));
//]]>
</script>
...with this...
<script type="text/javascript">
//<![CDATA[
review = new Review('<?php echo $this->getUrl('checkout/onepage/saveOrder', array('form_key' => Mage::getSingleton('core/session')->getFormKey())) ?>', '<?php echo $this->getUrl('checkout/onepage/success') ?>', $('checkout-agreements'));
//]]>
</script>