Is the scriptPubKey of a previously unseen transaction in an incoming block checked? If so, where?
The behaviour of the mempool or orphan tx pool should not influence the validity of blocks at all.

When a block comes in:


main.cpp:ProcessMessage deals with processing messages, and dispatches to:
main.cpp:ProcessNewBlock deals with specifically processing block messages, which stores it on disk using AcceptBlock and then calls:
main.cpp:ActivateBestChain tries to verify the potentially new best chain and switch to it. For every atomic "reorganization" step, it calls:
main.cpp:ActivatebestChainStep which will try to verify new blocks to be added to the tip of the chain using:
main.cpp:ConnectTip which does the actual processing using:
main.cpp:ConnectBlock, which will iterate through the block's transactions and verify their inputs using:
main.cpp:CheckInputs which builds up a list of CScriptCheck objects for each script execution to be performed, which are verified from another thread. ConnectBlock waits for these threads to finish and deal with the result. In those threads, we call:
main.cpp:CScriptCheck::operator() which performs a single encapsulated script execution, using:
script/interpreter.cpp:VerifyScript to do a verification of script, which consists of executing a scriptPubKey + its spending scriptSig using:
script/interpreter.cpp:EvalScript.


So, EvalScript() should be executed for all scriptPubKeys which are spent by a block, before that blocks ends up being accepted as a tip.