As described in the
MS-ADTS 3.1.1.3.4.1.12 LDAP_SERVER_SEARCH_OPTIONS_OID
http://msdn.microsoft.com/en-us/library/cc223324.aspx
we must not search the application NCs, when we use the SERVER_SEARCH_FLAG_PHANTOM_ROOT (--cross-ncs) flag.

"For AD DS, instructs the server to search all NC replicas except application NC replicas that are subordinate to the search base, even if the search base is not instantiated on the server. For AD LDS, the behavior is the same except that it also includes application NC replicas in the search. For AD DS and AD LDS, this will cause the search to be executed over all NC replicas (except for application NCs on AD DS DCs) held on the DC that are subordinate to the search base. This enables search bases such as the empty string, which would cause the server to search all of the NC replicas (except for application NCs on AD DS DCs) that it holds."