After submitting the payment details screen NOP throws an exception if you are using SQL as the session provider.
Unable to serialize the session state. In 'StateServer' and 'SQLServer' mode, ASP.NET will serialize the session state objects, and as a result non-serializable objects or MarshalByRef objects are not permitted. The same restriction applies if similar serialization is done by the custom session state store in 'Custom' mode.
This seems to be caused by the following classes not being marked as serializable: NOP.Core.BaseEntity Nop.Core.Domain.Customers.Customer Nop.Core.Domain.Orders.Order Nop.Services.Payments.ProcessPaymentRequest
Potentially more classes need to be markd dependending on the configuration of nop used.
I've been playing with my own copy of the source code, and the [Serializable] attribute really needs to be applied to all of the classes descending from the BaseEntity class in case they are ever stored in the session. The ones listed are just the ones that the check out process uses (and possibly the only ones currently stored in the session heap).