I'm not sure (you have to dive into TimerOne library) but I'm getting the feeling .stop() might not remove the timer interrupt flag. So if the interrupt fires before interrupts are disabled it is queued and executed after interrupts resume. Or even (but not 100% sure), if a specific interrupt is off but global interrupts on, it only means the ISR isn't called, not that the flag isn't set. Aka, the the flag is still set when an interrupt fires only no code is run. But once you turn on the interrupt and the flag is still set it will run the code.
But there are more then one library called TimerOne so which do you use?
Also, quick note, when entering a ISR, interrupts are disabled by default. No need to do it yourself 