I'm absolutely astonished at some of these responses.
This is how abuse gets normalised.
The fact that 'there's a lot of CSA about' does not mean that we have to shrug at it.
Child abusers don't announce themselves to a child, or a parent. And the reason children are so vulnerable is precisely because they are groomed by society, before any abuse is enacted, to trust and defer to adults.
In having that man in her home, the OP is giving him a seal of approval. Her children will learn that he has the status of all the other to whom s/he must defer.
It needn't be a question of it happening there and then - it will lay the groundwork for future interactions.
Though in fact - as any reader of the many accounts of women who were themselves abused as children on MN knows - there are a million ways to get a child alone when 30 seconds is long enough. And many abusers do it in plain sight of other adults, who are conditioned not to believe their own instincts (or eyes).
OP, you have to say to the woman (who has herself betrayed her own child and is therefore absolutely not to be trusted) 'We're lookng forward to seeing Tommy, but unless you plan to drop and run please make sure that it's you that brings him."
She will know what you mean - and if she can't be grateful for your humanity towards her child, then she's even more contemptible. She is the one who has isolated her child by maintaining ties with an abuser. Seriously, fuck her.