If the code calls node_save() passing to the function a node object that is associated to user Y (i.e., the value of
node->uid is the user ID of user Y), the function will save the node without checking if a node of that content type can be created from the user. It is the code that calls
node_save() that eventually checks if the user has the permission of creating that content type, or it's the code that shows the link to the form for creating a node of a content type that makes the link visible only to users who has the permission to create nodes of that content type.
node_save() allows you to save a node that is associated to a user who don't have the permission to create a node of the content type Y; the problem is eventually when the user X doesn't have the permission to update nodes of the content type Y, which would not allow the user to update the node that has been created for him.