luatex has more write streams and \write16 is not special with this engine. This means that the messages of pgf which uses \immediate\write16 can end up in other open files. In this example e.g. (compiled with --shell-escape) they end up in the toc:
\documentclass{book}
\newwrite\blubi
\newwrite\blubii
\newwrite\blubiii
\newwrite\blubiv
\newwrite\blubv
\newwrite\blubvi
\newwrite\blubvii
\newwrite\blubviii
\newwrite\blubix
\newwrite\blubx
\newwrite\blubxi
\newwrite\blubxii
\RequirePackage{tikz}
\usetikzlibrary{external}
\tikzexternalize
\tikzset{external/system call={lualatex
\tikzexternalcheckshellescape -halt-on-error -interaction=batchmode
-jobname "\image" "\texsource"}}
\begin{document}
\tableofcontents % \tf@toc=\write16
\begin{tikzpicture}
\draw(0,0)--++(1,1);
\end{tikzpicture}
Hello world
\end{document}
The suggestion of the latex team is "to be portable and use an unopened stream you can use any number bigger than 127 or use \@unused"
http://tug.org/pipermail/luatex/2015-November/005485.html
A search found the following files which are probably affected
basiclayer/pgfcoreexternal.code.tex
frontendlayer/tikz/libraries/tikzexternalshared.code.tex
libraries/pgflibraryprofiler.code.tex
math/pgfmathfloat.code.tex
utilities/pgfkeysfiltered.code.tex
It would probably also a good idea to use a command e.g. \pgf@typeout{....} instead of a hard-code \immediate\write16 and define this in one place.
Last edit: Stefan Pinnow 2018-12-23
Thank you for reporting. We followed your suggestion and the bug is fixed now.