As first reported in http://mail.openjdk.java.net/pipermail/build-dev/2007-October/000316.html :

j2se/make/sun/security/pkcs11 now runs

# Running javah:
/java/re/jdk/1.7.0/promoted/latest/binaries/solaris-i586/bin/javah -bootclasspath ../../../../build/solaris-i586/classes -d ../../../../build/solaris-i586/tmp/sun/sun.security.pkcs11/j2pkcs11/CClassHeaders/ \
        sun.security.pkcs11.wrapper.PKCS11 sun.security.pkcs11.Secmod

But that is wrong since it sets CLASSDESTDIR. It used to be (in JDK 6 and I believe earlier JDK 7 builds)

# Running javah:
../../../../build/solaris-i586/bin/javah -J-XX:ThreadStackSize=768 -J-client -J-Xmx512m -J-Xms256m -bootclasspath ../../../../build/solaris-i586/tmp/sun/sun.security.pkcs11/j2pkcs11/classes \
        -d ../../../../build/solaris-i586/tmp/sun/sun.security.pkcs11/j2pkcs11/CClassHeaders/ \
        sun.security.pkcs11.wrapper.PKCS11 sun.security.pkcs11.Secmod

Note the bootclasspath.

There was an email exchange with Jon back on 6/25 where he suggested that the bootclasspath for javah should be set to $(CLASSDESTDIR):$(CLASSBINDIR), but make/common/shared/Defs-java.gmk just says
JAVAHFLAGS += -bootclasspath $(CLASSBINDIR)

Should this be changed in Defs-java.gmk?