Often when I have smb file shares connected to my mac (10.6.4, but if I remember correctly i've had this problem at least on some 10.5.x versions too on the same machine) Apple's firewall popup asks if I want to allow Finder or what ever application I happen to be using (even something like System Preferences sometimes) to accept or deny connections. This popup disappears so quickly that it's impossible to click on it. Sometimes appearing multiple times when for example in Save as dialog, even if saving to a local disk.
In my firewall settings I've allowed File Sharing (SMB), Remote Login (SSH), Screen Sharing and Web Sharing. It doesn't make any difference if the application is not mentioned in the Firewall settings or set to Allow or Block incoming connections.
Just tested this for TextEdit, typed something random into it, chose Save As, waited for two seconds and the popup appeared. Nothing in any logs about TextEdit at all.
Automatically allow signed software to receive incoming connections is disabled, as is Enable stealth mode.