The javadoc for ObjectInputStream.resolveClass() states:

  By default the class name is resolved relative to the class that
  called readObject.

This statement is inaccurate (and has been present since JDK1.1). It should
be changed to reflect serialization's actual class resolution algorithm,
in which the name is resolved against the "latest user defined loader"
(not including class loaders for generated reflection implementation classes).