This issue is a side effect of the Permissions classes:

• DjangoModelPermissions https://github.com/tomchristie/django-rest-framework/blob/master/rest_framework/permissions.py#L111
• DjangoObjectPermissions https://github.com/tomchristie/django-rest-framework/blob/master/rest_framework/permissions.py#L172

The permission code is called in the initial() method https://github.com/tomchristie/django-rest-framework/blob/master/rest_framework/views.py#L471 , just before the request method validation https://github.com/tomchristie/django-rest-framework/blob/master/rest_framework/views.py#L474

Steps to reproduce

Enable rest_framework.permissions.DjangoModelPermissions on a ViewSet and submit any Method Not Allowed, one that is not in that dict: https://github.com/tomchristie/django-rest-framework/blob/master/rest_framework/permissions.py#L90

Expected behavior

A proper "405 Method Not Allowed" as returned by https://github.com/tomchristie/django-rest-framework/blob/master/rest_framework/views.py#L474

Actual behavior

"500 Internal Server Error"