I've had the case with SharePoint 2010 site collection what was set during creation to use UserAccountDirectoryPath to specific OU. It created w/o exceptions but wasn't following the restriction instead People Picker showed all AD users.
I've noticed that some site collection properties being check through a browser throw exceptions. I've deleted and re-created site collection and it helped. How can i check if site collection admin can add users from AD? I've tried a couple of PS and object model scripts but failed. Maybe there's way to check a site collection health?