EJB Timer Service broken when used with security domain

When an EJB (an entity bean in my case) has a security
domain associated with it, calls to the ejbTimeout
method fail with a SecurityException (insufficient method
permissions). It appears the principal is being hardcoded
to null in the TimedObjectInvoker, causing the security
check to fail in the SecurityInterceptor. I have tried
setting the method permissions for ejbTimeout to
unchecked, but these aren't picked up, possibly because
ejbTimeout is not a member of the bean's local
interface.