Doing a Demand probably makes a little more sense, although not a whole lot. An alternative could be to change the Create() method to distinguish between public, private and internal access and when internal access is requested explicitly look for the InternalsVisibleToAttribute on the target assembly to see if it grants us access, but that seems like a lot of complexity for what is essentially a special case (internal access).

runtime/openjdk.cs

@@ -271,8 +271,6 @@ namespace IKVM.Runtime
 
 static class DynamicMethodUtils
 {
-	private static bool? restrictedMemberAccess;
-
 	internal static DynamicMethod Create(string name, Type owner, bool nonPublic, Type returnType, Type[] paramTypes)
 	{
 		try
@@ -305,11 +303,15 @@ static class DynamicMethodUtils
 	{
 		get
 		{
-			if (!restrictedMemberAccess.HasValue)
+			try
 			{
-				restrictedMemberAccess = System.Security.SecurityManager.IsGranted(new System.Security.Permissions.ReflectionPermission(System.Security.Permissions.ReflectionPermissionFlag.RestrictedMemberAccess));
+				new System.Security.Permissions.ReflectionPermission(System.Security.Permissions.ReflectionPermissionFlag.RestrictedMemberAccess).Demand();
+				return true;
+			}
+			catch (System.Security.SecurityException)
+			{
+				return false;
 			}
-			return restrictedMemberAccess.Value;
 		}
 	}
 }