Using firebug (or chrome or ie dev tools) check if your redirect button redirects you to correct address. (For example you may expect that it redirects to
http://mysite/sites/cars/_layouts/myApplicationPage.aspx, but it actually redirects to
http://mysite/_layouts/myApplicationPage.aspx where you get access denied).
And also (this is not an answer, but note), it is absolutely no make sense to use
RunWithElevatedPrivileges to access
_layouts is a virtual directory in iis, which means that it maps to the physical path (for sharepoint it is
14\template\layout). Every sharepoint web application has this virtual directory, which means that yes, it is accessible between all web applications.
You may have two site collections under
http://mysite/sites/sitecol. Your application page is accessible using
http://mysite/sites/sitecol/_layouts/myapplicationpage.aspx. But when user access to this application pages security still working for user, because it requests page in particular site collection. And this means that if user has no sufficient rights under
http://mysite/ he gets access denied under
http://mysite/_layouts/myapplicationpage.aspx, but can successfully navigate to
http://mysite/sites/sitecol/_layouts/myapplicationpage.aspx (again, if user has rights).
Hope I answer your question.