Java Kernel still finds lib/ext classes even when -Djava.ext.dirs is overridden

Test run with:
java version "1.6.0_10-ea"
Java(TM) SE Runtime Environment (build 1.6.0_10-ea-b07)
Java HotSpot(TM) Client VM (build 1.6.0_10-ea-b07, mixed mode)

Steps to reproduce:
1. Install the kernel jre "*windows-i586-p-iftw-k.exe"
2. Make sure run the test from kerneljre's "initial form"
   (either immediately(before Kernel has time to finish background downloading)run test after install, or perform step 3 4)
(optinal)3. Kill the background download ( by killing the "java" process )
(optinal)4. Remove all files under ${ProgramFiles}/Java/jre6/lib/bundles/
5. Unarchive the attached .tar and go into the target directory, Run Test use following command:
   java -Djava.ext.dirs=ext -Djava.security.policy=perm.jp -Djava.security.manager Test

It should not throw any exception with
            java.security.Security.addProvider(new com.rsa.jsafe.provider.JsafeJCE());

But it threw
Exception in thread "main" java.lang.ExceptionInInitializerError
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
        at java.lang.reflect.Constructor.newInstance(Unknown Source)
        at java.lang.Class.newInstance0(Unknown Source)
        at java.lang.Class.newInstance(Unknown Source)
        at sun.security.jca.ProviderConfig$3.run(ProviderConfig.java:240)
        at java.security.AccessController.doPrivileged(Native Method)
        at sun.security.jca.ProviderConfig.doLoadProvider(ProviderConfig.java:225)
        at sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:205)
        at sun.security.jca.ProviderList.loadAll(ProviderList.java:264)
        at sun.security.jca.ProviderList.removeInvalid(ProviderList.java:281)
        at sun.security.jca.Providers.getFullProviderList(Providers.java:158)
        at java.security.Security.insertProviderAt(Unknown Source)
        at java.security.Security.addProvider(Unknown Source)
        at Test.main(Test.java:31)
Caused by: java.security.AccessControlException: access denied (java.lang.RuntimePermission loadLibrary.sunmscapi)
        at java.security.AccessControlContext.checkPermission(Unknown Source)
        at java.security.AccessController.checkPermission(Unknown Source)
        at java.lang.SecurityManager.checkPermission(Unknown Source)
        at java.lang.SecurityManager.checkLink(Unknown Source)
        at java.lang.Runtime.loadLibrary0(Unknown Source)
        at java.lang.System.loadLibrary(Unknown Source)
        at sun.security.mscapi.SunMSCAPI$1.run(SunMSCAPI.java:34)
        at java.security.AccessController.doPrivileged(Native Method)
        at sun.security.mscapi.SunMSCAPI.<clinit>(SunMSCAPI.java:32)
        ... 16 more