If he is a member of the DDL-ADMIN fixed role he could take a database offline (as far as I am aware) and then bring it online.

He wouldn't be able to expand it if he was not mapped to the database at the time of trying to expand the tree or had DB_DENYDATAREADER. At the time he brings the database back online he is automatically mapped which means expanding the tree is no longer a problem.

Only a rough guess that I pulled out of the air.....