Yes unfortunatelly they can not reproduce the bug, because they trying with class files next to the jar files, and in this way the security exception they got is normal. It seemed to me they have not tried with only the jar files.
In the sun developer comment of the bug, was only one thing i have not tried ever, i have never enumerated all the jar files for the codebase property since this list have to take place in the manifest of the main jar as the ClassPath. After the suggestion, i have tried this, but nothing happens, and the problem persist with enumerated jars also.
I have tested this with an early access build of 1.6.0_18 and the problem is persist with that too.
I would rahter not give estimations since we are not absolutely sure about the root of the problem, so currently we do not have any plan on how to fix this.
The only thing i can tell is that, now we are concentrating on the last fixes for the feature set of Marvin and Jchem 5.3 release, after the release is out, we will investigate further possibilities on this class loading problem.