Unintentional side-effect of Oswin's hacking into the Dalek net/TARDIS/etc... maybe.
Possibly. Here's my theory, which I think is too complicated for Moffat (who tends to go with the simplest solution possible):
The Doctor gave up his protection against the Dalek nanoprobes on the Asylum. He may have been immune to them, but he still carried them, and possibly he left some here and there and everywhere throughout time and space. Left to their own devices, these rogue nanoprobes reshape a human into Oswin.