Hostile mobs can spawn at max height at any time, day or night.
Likely because y=256 is not a tracked block, there is no associated light value. Thus a null value is being passed for the light value. For integers, the turns out to be a 0, which would indicate allowable spawning positions. Suggest that light levels for blocks where y > max_height return the current sunlight level.
Easily verifiable using the Superflat worlds (just ensure blocks are up to 255 or server max height).
Duplicate of MC-68565