I don't think we're fully done yet with
(though I'll open another issue, since #829856 has already been incorporated in a stable release)
The fix included an addition of node_load($file['nid'])) - but $file is not always filled here. Which means the 2nd argument to filefield_view_access() is FALSE.
And that makes stuff choke. I have a content_access module enabled, and my cron runs were crashing on a drupal_clone(FALSE) call which originated from filefield.
I guess there should just be a proper check for $file['nid']?
And while we're at it -- maybe it's good to change the order of the checks, because filefield_view_access() can be more resource intensive than filefield_file_listed()?
( I don't know what I'm talking about really -- but it seems that way to me :) )