When viewing an SSL page with non-SSL content, a message is presented to the user asking if they want to view non-secure content. If they click "Yes", no product images will show up. There's probably a more elegant solution to this, but I fixed it by using:
if (Page.Request.IsSecureConnection)
pictureUrl = pictureUrl.Replace("http://", "https://");
I put this right before
return pictureUrl;
in OrderSummary.ascx.cs. This will cause images to be loaded via HTTP when on the HTTP portion of the site and HTTPS when on the HTTPS portion of the site.