I've just experienced what I think is a bug. I'm not using the very latest WordPress.org version (I think I'm one revision behind the current release), so this may have been fixed already. Anyway, here's what happened:
I have a Contributor-level user who had one unapproved post. They were only able to see that one post in the list of posts on the Edit Post page (this is as it should be, I believe). However, on deleting that post from the list (as it was no longer needed), suddenly, all the posts by all others users appeared (though they could only be viewed, not edited). On logging out, and back in again, all posts were still visible (though again, not editable).
Anyone else come across this? I have a number of plugins installed, including the Magic Fields custom write panel plugin, which I know manipulates the posts list, so it could be to do with this. I can't easily uninstall it to test, however. Anyone come across anything like this before?