[Though this is about code in sun.applet.AppletSecurity, I think that the
security group has been responsible for this class, and hence my categorization
of this bug...]

From line 280 (or 249) of src/share/classes/sun/applet/AppletSecurity.java:

            SocketPermission sp = new SocketPermission(host+":port","connect");

Notice how "port" is inside the quotation marks, thus the string "port" is
passed literally rather than passing the string representation of the port
value. This results in an IllegalArgumentException from the SocketPermission
constructor, an unchecked RuntimeException, which ends up being thrown instead
of the intended AccessControlException.

This code will get executed if the AccessController denied the attempted
connection, but the "current class loader" is not an AppletClassLoader
(including if it is null). I've run into this happening when the current
thread contains only CLASSPATH classes (so the "current class loader" is
null) but thread is inheriting an applet's AccessControlContext. It would
seem that this thread should be able to make a connection to the applet's
codebase host, but this will fail because the AccessController's policy
cannot specify that code from an applet's domain can connect to the applet's
codebase host, and the thread has no AppletClassLoader on the stack, which
is how the AppletSecurity manager normally explicitly handles connection
checks. But instead of getting an AccessControlException, an
IllegalArgumentException is thrown instead.