What happens when an encrypted wallet runs out of keys? Say someone wanted to be evil to the main client and set its wallet to contain one key, lock it, and then start mining. After the first block was generated, the client would traditionally create a new key to use for mining and store it in a wallet. However, as it doesn't have the password in memory, it can't encode the key. How would the client respond in this situation? Use an old key for generation, store the key unencrypted, or do something entirely different?
If the key pool is empty and the wallet is locked it will use an old key instead of generating a new key. When wallet encryption was implemented the block creation code was changed to make sure different coinbase transactions are generated in that case.