User with 'edit all contacts' but no delete permissions can delete contacts

See http://forum.civicrm.org/index.php?topic=20029.0
Tested on Civi 3.4.4 / Drupal with 'Contact Trash & Undelete' both on and off.

To replicate:
(1) Set up a user with permissions 'access CiviCRM', 'add contacts', 'edit all contacts', 'view all contacts'.
(2) Find Contacts.

Observed behaviour:
'Delete contact' appears in 'more' context menu beside a contact in the results selector.
User can delete the contact.

Expected behaviour:
'Delete contact' should not appear in 'more' context menu.
User should not be able to delete the contact.