I tracked this down and sort of documented what I was seeing in this thread:
https://openacs.org/bboard/q-and-a-fetch-msg.tcl?msg_id=000504&topic_id=OpenACS&topic=11I still think it's a bug but haven't gotten back to it to see if I can fix it without compromising the security model.