Interesting. Some relevant spec:

There is a failure, but I think you have it backwards.

While the :checked pseudo-class is dynamic in nature, and can altered by user action, since it can also be based on the presence of semantic attributes in the document, it applies to all media. For example, the :checked pseudo-class initially applies to such elements that have the HTML4 selected and checked attributes as described in Section 17.2.1 of HTML4, but of course the user can toggle "off" such elements in which case the :checked pseudo-class would no longer apply. -- http://www.w3.org/TR/selectors/#checked

So, "[checked]" should only apply to elements that had a checked attribute initially set in their HTML. The .filter("[checked]") would be wrong then, I suspect it is going through Sizzle and looking at the property rather than the attribute. If so there's already a ticket for that and I'll look at it later.

Found the duplicate ticket, which also points out we can't fix this until we remove the boolHook that fixes old broken uses of .attr(). BTW, thank you for the extensive test case!

Duplicate of #11115.