msg.data is usually ABI encoded information that indicates to the contract the function and parameters to invoke.
Using standard tools,
msg.data will be the same if the contract is called with the same parameters. However, hashing it with the
block.number as in
sha3(msg.data, block.number) will produce a completely different result, for each block.
msg.data is malleable. For example, extra trailing zeroes can be appended to
msg.data without changing the function that will be invoked in a contract. Using standard tools (like web3.js) will not create extra trailing zeroes, but you should examine your use case when using
msg.data as an identifier, to ensure that malleability will not cause an issue or vulnerability.
(In the specific wallet case in the question, malleability of
msg.data by an owner only seems to cause confusion for themselves or other owners.)