Without the screenshot and an idea of the applications state at that moment that's kind of hard to answer.
What you could do, is figure out the IP address of the user (that shouldn't be too hard), then go back into the log files and check all their actions one by one rebuilding the state up to the moment of the bugs occurrence.
Chances are that you'll be able to reproduce it that way, even if the user is clueless.
This little trick saved my ass a couple of times.