spreport.sql shouldnt ask for the hash value as this is derived from stats$sql_summary and v$sql_text - are you sure the spreport.sql hasnt been modified by anyone? You could try running it with set verify on to see where the hash_value is being asked for.

P.S What version are you running?