The subclasses of ClassLoader (SecureClassLoader, URLClassLoader) perform a redundant "createClassLoader" permission check:

    protected SecureClassLoader() {
        super();
        // this is to make the stack depth consistent with 1.1
        SecurityManager security = System.getSecurityManager();
        if (security != null) {
            security.checkCreateClassLoader();
        }
        initialized = true;
    }

ClassLoader() already performs the check, so SecureClassLoader does 1 xtra check, and URLClassLoader does 2.