I have File Vault 2 full-disk encryption enabled on my 2012 MacBook Air running Mountain Lion. By default it also has a "Guest" Safari-only account available. I just tried it the other day and found that it requires no password to boot the system and run Safari.
To my untutored eye, this seems like a major security risk to the full-disk encryption. It could be a back door to obtaining the key to decrypting the entire disk. Prior to this, I was under the impression that the disk could only be decrypted if you have a password or a recovery key. If this back door is really there, then I could imagine someone taking the SSD out of the Mac and reconstructing the process used by the Guest account to obtain the key to decrypt the disk without a password or recovery key.
So my question is: is this the risk that I perceive it might be? Or is there perhaps a separate bootable operating system on a small part of the disk with its own encryption key just for the Guest Safari access?
If it is the risk I think it is, then how do I kill the Guest access? When killing it, how do I know that it has removed all remnants of the exposure of the decryption key for the full disk?
I see from other questions that in Lion it was not possible to create such a Guest account with File Vault 2 on, but now in Mountain Lion it is there by default. Perhaps Apple has in fact made the Guest account secure. Or perhaps they left a back door open. I can't find anything about this particular question with respect to Mountain Lion in the Apple knowledge base.