Another hole is that you can launch Safari from Apple Help even if Safari is not on the allowed application list. This is how my son showed me he does it: (Safari is not on the list of programs he can use BTW).
1. Open Apple Help
2. Click on any hyperlink that takes you to a website.
3. Safari launches. From there you have unrestricted access, other than whatever restrictions you put on Safari, to the internet.
4. Right-click on the Safari icon in the dock to launch on login.
The next time you log into the account, Safari launches automatically.
It appears that the limit on what apps you can launch is a Finder-only limitation, and as you've shown, it's easily defeated. The OS will launch whatever application it is called upon to launch.
Microsoft Provides Easy OS X Security Hack