Possible bug in acl/http_access handling?

I am trying to block ActiveX and Java with the following 4 entries:

acl activex urlpath_regex \.asp # regexp matching on any ActiveX prg
acl java urlpath_regex \.class # regexp matching on any Java prg

http_access deny activex
http_access deny java

But wether I uncomment the first of the two http_access lines, the second
or both, the following URL gets cache access denied:

http://squid.nlanr.net/Squid/documentation.html

When both http_access lines are commented out, I can get the URL.

What do I have to check to locate this (what seems to be a) bug? My
NEXTSTEP version uses the GNU regexp that comes with squid. I am running
1.1.8.

---
Gerben_Wierda@RnA.nl (Gerben Wierda) NEXTSTEP RD242
"If you don't know where you're going, any road will take you there"
Paraphrased in Alice in Wonderland, originally from the Talmud.
Renee: "Met veel koper maakt men hoempa." (After hearing a Nielsen symphony)