Strict URL alias checking with optional 404 redirect
You can use the url_inbound_alter hook to verify if the internal path of the request matches the used url alias. If not, trigger a 404.

function YOURMODULE_url_inbound_alter(&amp;$path, $original_path, $path_language)
{   
    if ($path === $original_path) {
        // path is same as url alias - don't do anything
        return false;
    }

    $alias = drupal_get_path_alias($original_path);
    if ($alias &amp;&amp; $alias === $original_path) {
        // alias is same as url alias - don't do anything
        return false;
    }

    drupal_not_found();
    drupal_exit();
}


I've tested on some projects which are using the most common contrib modules (Pathauto, Globalredirect, Views, Sitemapxml, Wysisywyg, ...), and I don't have the problem. Url alias verification is strict and returns 404 for non existing aliases. But I'm able to reproduce it with custom menu callbacks (custom code or views).