Steps to reproduce:
- Go to your profile and set "DISPLAY HIDDEN PAGES" to No
- Go to http://localhost:8080/xwiki/bin/view/Main/AllDocs?view=attachments
The attachments for all pages are listed; for example those of XWiki.WatchListMessage, which is a hidden page.
The attachments listed should take in consideration the user's setting for hidden pages.