I create a subnode to a given major node with "restrictive" ACLs, so nobody (except the creator) should be allowed to read the node. Still any user can check the existence of the node via

node.hasNode("foo")

since the hasNode operation never actually checks the ACLs. See the attached forum reference.