Does the permission caching stuff time out? It looks like it calls util_memoize without a time out. This would be *very* dangerous ... the cache can become incorrect if code changes an object so it doesn't inherit permissions or gets them from a new context, etc.
