Limitations do not work when you assign a "State assign policy" moreover if you do not specify any assignable state Xdebug throws many nasty error messages.

I debuged the code ezcontentobject ->allowedAssignStateIDList the first problem is due to this wrong logical assignment:
$allowed = in_array( 1, $values ) and $userID != $ownerID;

i changed it to:
$allowed = (in_array( 1, $values )) && ($userID == $ownerID);
the second problem is caused by variable $sql not being defined when the policy is assigned with limitations.

I'm attaching a patch against ez 4.2.0

Steps to reproduce

Create this policy:

state assign Owner( Self ) (do not select any assignable state while specifying the limitations)

and assign it to a user then try to assign a policy to something you do not own.