watermelon_2001 may be correct in his assessment. In addition to the SMR and TKEs, another option is Romanian Deadlifts making sure she keeps the knees at about 10 degree flexion. Among healthy population, anywhere from 10-20 is the standard, but for her, you'll of course have to modify.
The reason for the posterior chain work is that the hamstring complex helps to isometrically stabilize the knee. This is a reason why I also like the seated unilateral hamstring curl (which your client may or may not be able to do as the force vector is opposite of extension). The leg curl targets the biceps femoris short head (the only muscle in the hamstring complex which does NOT extend the hip but only flexes at the knee).
That said, you're in a bind IMO. As a trainer, there comes a point in which we must refer a client out to get medical diagnosis. Not only is this the ethical move, it covers your tail legally. However, in this economy, trainers have enough trouble finding clients with discretionary income.
I've had clients just like the one you're describing. It's frustrating to say the least and I had to show them the door because the best I could do - and I flat out told them - is that I can train around the injury but I refuse to program any movements that could cause further trauma.
The ultimate decision with this person is yours, of course. Maybe you can write up a custom waiver in which you specifically state that: 1) you advised a medical examination and the client refused; 2) you and client agreed to train around the injury until said client had the issue diagnosed.