Even if the simulator disallows flying, the server relies on the client to honor the restriction. For example, Singularity includes (without source-code modifications) an option to toggle an option which allows an agent to always fly - regardless of the simulator permissions. Many protections are embedded into the client, without any server-side checks.
It is remarkable how broken the whole system Linden came up with is. The patch modifies the Singularity viewer so that the built-in, client-side, shallow 'security' is disabled. The patch below is meant for the Singularity viewer and turns the viewer into a God-like client with the ability to export most assets from either Second Life or OpenSim.
