Should work... Seems like a bug. Can you provide a testcase?
Oh. Pardon me please! It was my mistake. I'm using Eclipse RAP framework, it use global ThreadPool. So security context correct propagate from parent to child thread, but there is no guarantee that parent and child context are equals.