old key was simply "id" so when a container is a VirtualFolder (like Web Site), container._getOb("id") can return any object with id "id" including an object outside the container.
Change the key to contain PhysicalPath of the container to get only objects inside the container.
This actually fixes installation of some business templates with Web Site inside.