Of special note, though not directly relevant to formulas, is that the permissions of a document referenced by a document field are overridden by the permissions of the field.  The feature is explained here because a technical understanding of this feature may be important to the way a formula is designed. 

If a person has edit access to a document field, they will also have edit access to the document referenced by that field.  If a person has create privilege to the field, they will have create permission to the document, namely they can view the version history and upload new versions of a versioned document.  If a person has view permission to the field, they will be able to view the document.  A person with no access to the field will also have no access to the document.  These rules override any permissions defined for the document itself, including the normal edit permission given to the creator of a document.  Please remember that these behaviors are derived strictly from the permissions of the field and are not affected by the field locking and hiding settings of the field.

If multiple document fields reference a single document, the rules are quite complex.  A person will have view/participate permission to a document if they have view/author permission, respectively, to ANY of the fields referencing the document.  Conversely, a person will have author/edit permission to a document only if they have author/edit permission, respectively, to ALL of the fields referencing the document.  This prevents a person with edit permission to one document field from creating a reference to a document which is referenced by a more secure field in order to defeat security.  For view privilege, this is not a problem because the person cannot see it to select it.  Instead, a friendlier policy is enforced which prevents the problem of being able to see the field, but not being able to see the document it references.  This security policy also makes it possible to create an effect on a document similar to field locking (but not field hiding) of a field.  Namely, a document may be locked by creating a reference to it from a field with restricted permissions.