When does hook_node_access() get invoked for $op == "create"?
It gets called from _node_add_access(), which is the access callback for the node/add path (see node_menu()):

foreach ($types as $type) {
  if (node_hook($type-&gt;type, 'form') &amp;&amp; node_access('create', $type-&gt;type)) {
    return TRUE;
  }
}


node_access() has this line in it:

$access = module_invoke_all('node_access', $node, $op, $account);


Which is when hook_node_access() is actually invoked.

To answer your question, it's called before the node add form is ever displayed to a user; obviously if it returns FALSE then access is denied to the form.