Don't use mass-assignment protection when applying the scoped.scope_for_create. Fixes #481.

activerecord/lib/active_record/associations/collection_association.rb

@@ -99,7 +99,6 @@ def build(attributes = {}, options = {}, &block)
         else
           add_to_target(build_record(attributes, options)) do |record|
             yield(record) if block_given?
-            set_owner_attributes(record)
           end
         end
       end
@@ -423,7 +422,10 @@ def insert_record(record, validate = true)
         end
 
         def build_record(attributes, options)
-          reflection.build_association(scoped.scope_for_create.merge(attributes || {}), options)
+          record = reflection.build_association
+          record.assign_attributes(scoped.scope_for_create, :without_protection => true)
+          record.assign_attributes(attributes || {}, options)
+          record
         end
 
         def delete_or_destroy(records, method)

activerecord/lib/active_record/associations/through_association.rb

@@ -14,7 +14,9 @@ module ThroughAssociation #:nodoc:
         def target_scope
           scope = super
           chain[1..-1].each do |reflection|
-            scope = scope.merge(reflection.klass.scoped)
+            # Discard the create with value, as we don't want that the affect the objects we
+            # create on the association
+            scope = scope.merge(reflection.klass.scoped.create_with(nil))
           end
           scope
         end

activerecord/test/cases/associations/has_many_associations_test.rb

@@ -86,11 +86,20 @@ def test_create_from_association_set_owner_attributes_by_passing_protection
     bulb = car.bulbs.new
     assert_equal car.id, bulb.car_id
 
+    bulb = car.bulbs.new :car_id => car.id + 1
+    assert_equal car.id, bulb.car_id
+
     bulb = car.bulbs.build
     assert_equal car.id, bulb.car_id
 
+    bulb = car.bulbs.build :car_id => car.id + 1
+    assert_equal car.id, bulb.car_id
+
     bulb = car.bulbs.create
     assert_equal car.id, bulb.car_id
+
+    bulb = car.bulbs.create :car_id => car.id + 1
+    assert_equal car.id, bulb.car_id
   ensure
     Bulb.attr_protected :id
   end