Well done! Committed and pushed to 7.x. :)
Cool, so that needs to be merged with the code for the node access issue. That's in the private tracker as #61339.
Actually, it looks like there's already a public issue for this with some patches at #1302404: D8 followup DRUPAL-SA-CORE-2012-002 - Access bypass - forum listing. Closing this as a duplicate.
Drupal is a registered trademark of Dries Buytaert.