Subtree criterion handler performs left join with ezcontentobject_tree. In case of multiple Locations this will produce multiple rows for the same Content. Negative match on one row won't filter out other rows, which produces incorrect result.

Reproduce with negative match on a subtree where Content has multiple Locations.