Item key: log["filename","keyword"]
Trigger expression: {log["filename","keyword"].nodata(1d)}=0

That's a brand new item with NULL lastvalue, lastclock, prevvalue etc fields.
Agent receives new configuration, tries to access and parse "filename", and fails - file "filename" doesn't exist.
Naturally item status changes to "Unsupported", but in the same time item's lastclock gets updated to current timestamp.
User fixes the problem of absent "filename" file, and changes item's status to "Enabled".
During next 30 seconds nodata(1d)=0 trigger fires up due to the way src/libs/zbxserver/evalfunc.c/evaluate_NODATA() is designed:

1275: if (item->lastclock + arg1 > now)
// we rely on lastclock and assume that item's history contains a value in required interval (when it might be empty)
1276: zbx_strlcpy(value, "0", MAX_BUFFER_LEN);

Thus the trigger fires and stays up for 1 day, when it shouldn't.