Update!
The scenario ran last night. Based on the suggestions above, I went with a pair of medusa rogues with silence cast before entering through the windows. I had mixed results. The fight was set up quite beautifully, and they easily got the drop on the PC int he first room.
He very nearly died (a lifesaving card was pulled out just as I was tyring to figure out how to backtrack it). He dove out the window and out of the silence to wake the others. The medusas were killed fairly easily in the ensuing fight, and nobody was killed or stoned.
Not a BAD outcome, but I would have rather they been discovered more in the middle of their rampage so it was more obvious that they were trying to cart off the PCs rather than just a concentrated attack on one individual.
And to answer a question, yes. They have been that careless.
They are in a big city, fighting a cult of the god of undeath. The temple, which they've just finished cleaning out, is also in the big city, a short distance away.
The temple is empty, but they know that the head bad guy (a vampire) is still at large. There is also at least one low level cultist unaccounted for. They believe that the corruption may be more widespread amongst the city's temples than they originally thought, and they have suspicions about one of the NPCs.
Despite all this, they each got separate (though adjoining) hotel rooms, and all went to sleep at the same time without setting watches, and with no magical precautions safe the Status spell that the cleric still had going from earlier in the day.
Of course, it didn't stop the player of the attacked PC from deciding that sending assassins in the night is a cheap shot...