This bug is due to the interplay between resolution of types and local inner classes and not to generics as it may seem at first. When the type FooImpl is accessed within the body of foo(), javac looks for a suitable enclosing instance from which FooImpl can be accessed. However, since FooImpl is a local inner classes (which means that the owner of FooImpl is a method and not a class), the process of finding such an instance fails. This, in turn, trigger the erasure of the symbol to be resolved, causing all type variable to be replaced by their declared bounds. This explains why javac complains about finding a T instead of an Object (the declared bound of T - the signature of foo() has already been erased!).
The problem has been introduced when fixing CR 5009484 in Mustang. A segment of code in Attr.java was added in order to access a given symbol through the most appropriate enclosing instance (the one in which the symbol is accessible, as not accessible symbols might hide accessible ones). However there's no point for performing an enclosing instance lookup when attributing a *TYPE*, since types are always acessible as toplevel types (inner classes get translated to toplevel classes) and no hiding occurs between class names (it's not possible for an inner class to have the same name as one of its enclosing classes).
The solution is in preventing the enclosing instance lookup when attributing a type.