Opening Lightning Application with not enough security access level raises internal error with Gack Id -227057212

Question

Opening Lightning Application which refers to SObject for which current running user doesn't have permission raises internal server error with Gack Id -227057212

Steps to reproduce:

1. Create custom object Custom_Object__c

2. Create Apex Class

   public class PILexCont {
   @AuraEnabled
   public static Custom_Object__c performBusinessLogic( ){
       Custom_Object__c record = new Custom_Object__c();
       insert record;
       return record;
   }
   }
   

3. Create an App

   <aura:application controller="PILexCont">
   <aura:attribute name="record" type="Custom_Object__c"/>
   <button onclick="{!c.performLogic}">Perform business logic</button>
   </aura:application>
   

4. With Javascript Controller

   ({
   performLogic : function(component, event, helper) {
   var action = component.get( "c.performBusinessLogic" );
   
   action.setCallback(this, function(response  ) {
       var state = response.getState();
       if (component.isValid() && state === "SUCCESS") { /* component.isValid() simply, checks if the component has been destroyed or not. (http://salesforce.stackexchange.com/questions/81998/what-does-the-lightning-component-method-component-isvalid-do) */
           alert('component valid, state success');
   
           var record = response.getReturnValue();
           component.set("v.record", record );
   
       } else {
           alert('error?'  );
       }
   
   
   });
   $A.enqueueAction(action);
   }
   })
   

5. Open an app by a user who doesn't have permission to Custom_Object__c

6. Obtain the error

    An internal server error has occurred
    Error ID: 1557802061-15979 (-227057212)

Answer 1

Salesforce Support refuses to accept this as a bug or to fix this but told me some internal bug #W-3285134 - not sure if it is related to this or not.

As workaround they suggested to give permission to that user.

Suggested to open Idea if I want this to be fixed.

=================

Update: as sfdcfox suggests, this may show up even when trying to declare an aura:attribute of type="function", with the intent of transporting a closure from one context to another for callback purposes. So it's not just an SObject, it can be any forbidden data type.