It is unfortunate that this query is on the first page of acs_subsite because it will fail sooner or later. From what I've seen it is not easily fixed either. My usual quick solution is to move the permssion check into the select part and get rid of the rows in TCL. That as least makes the query time dependent on the number of rows returned not the number of acs_objects.
