that's a test for a checkout when HEAD is not yet set. That kind of checkouts we do e.g. during clone to do the very first checkout.

You should also add a test for standard DirCacheCheckout which happens e.g. during a commit. I would simply do a second commit on refs/heads/master which tries to add malicious pathes. It's completely different code in DirCacheCheckout which is executed then and which is worth to be tested.