ADDITIONAL SYSTEM INFORMATION :
Operating system: OSX Mojave 10.14.6

Versions of Java:
java version "1.8.0_181" Java(TM) SE Runtime Environment (build 1.8.0_181-b13) Java HotSpot(TM) 64-Bit Server VM (build 25.181-b13, mixed mode)

java version "10.0.2" 2018-07-17 Java(TM) SE Runtime Environment 18.3 (build 10.0.2+13) Java HotSpot(TM) 64-Bit Server VM 18.3 (build 10.0.2+13, mixed mode)

java version "12.0.1" 2019-04-16 Java(TM) SE Runtime Environment (build 12.0.1+12) Java HotSpot(TM) 64-Bit Server VM (build 12.0.1+12, mixed mode, sharing)

A DESCRIPTION OF THE PROBLEM :
This behaviour was observed on OSX with Java 12.0.1, but also with older versions of Java (down to 8). It might occur on other platforms too (Windows, Linux).

The possible bug and how to reproduce it, is described in detail on Stack Overflow:
https://stackoverflow.com/questions/57433655/classnotfoundexception-issued-by-urlclassloader-when-the-security-manager-is-ena

If it is not a bug, a rationale for this behaviour would be very welcome.

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
See reference above

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
See reference above
ACTUAL -
See reference above

---------- BEGIN SOURCE ----------
See reference above
---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
A possible workaround for a user would be to inherit the URLClassLoader and override the findClass() method, but that would be a strange requirement.