In the Stored Procedure yaf_prov_role_exists, it takes the application as a parameter, but doesn't do a check against it (I don't think our version has been modified!):

BEGIN
DECLARE @ApplicationID uniqueidentifier

EXEC [dbo].[yaf_prov_CreateApplication] @ApplicationName, @ApplicationID OUTPUT

SELECT COUNT(1) FROM [dbo].[yaf_prov_Role]
WHERE RolenameLwd = LOWER(@Rolename);
END