Yes, SQL can go over what you have defined as the max server memory as certain things are stored in memory outside of the buffer pool.