Is the Guest account a security risk with full disk encryption on Mountain Lion? I have File Vault 2 full-disk encryption enabled on my 2012 MacBook Air running Mountain Lion.  By default it also has a "Guest" Safari-only account available.  I just tried it the other day and found that it requires no password to boot the system and run Safari.

To my untutored eye, this seems like a major security risk to the full-disk encryption.  It could be a back door to obtaining the key to decrypting the entire disk.  Prior to this, I was under the impression that the disk could only be decrypted if you have a password or a recovery key.  If this back door is really there, then I could imagine someone taking the SSD out of the Mac and reconstructing the process used by the Guest account to obtain the key to decrypt the disk without a password or recovery key.

So my question is: is this the risk that I perceive it might be?  Or is there perhaps a separate bootable operating system on a small part of the disk with its own encryption key just for the Guest Safari access?

If it is the risk I think it is, then how do I kill the Guest access?  When killing it, how do I know that it has removed all remnants of the exposure of the decryption key for the full disk?

I see from other questions that in Lion it was not possible to create such a Guest account with File Vault 2 on, but now in Mountain Lion it is there by default.  Perhaps Apple has in fact made the Guest account secure.  Or perhaps they left a back door open.  I can't find anything about this particular question with respect to Mountain Lion in the Apple knowledge base.
No, it's not. Some say it's a benefit if you have geo-location and remote wipe configured (or other similar software) as it increases the chance that someone finding the Mac will connect it to the Internet.

What's happening is that you also have Find My Mac on. That enables a Safari-only guest account which will allow users to log in and run Safari. The goal is that if someone steals your laptop, they might log into the guest account and give Find My Mac a chance to phone home.

The Safari-only guest account uses the unencrypted recovery partition to launch Safari. It does not decrypt your FileVault area at all, so your data remains safe.

(I've found an Apple knowledge base article confirming this.)