I have seen this behaviour on Windows 7 and Windows 10 RS3, probably on everything in between.
When the OS closes a *kernel* handle, it seems to attach the current thread temporarily to the System process. (KeStackAttachProcess or equivalent internal routine.) If the handle happens to be a file handle, *the following IRP_MJ_CLEANUP irp is dispatched while still attached to System*!
1) Is it documented behaviour? It has subtle consequences (e.g. APCs scheduled on that thread cannot run while attached to a different process), so it looks like it *should* be documented, but I could not find any references.
2) Anyone has any explanation why the system does it? Or is it just a bug from some olden times, which cannot be fixed for compatibility reasons?