I don't know exactly what you're seeing with the TreeView, I don't
normally use it. I just had a quick look and I saw that the TreeView does
in fact have this line on its WndProc:

  [SecurityPermission(SecurityAction.LinkDemand, Flags=SecurityPermissionFlag.UnmanagedCode)]

This is .NET 2, so it might have been changed from earlier versions - but
I would think the TreeView couldn't possibly work in an environment where
the UnmanagedCode permission is not granted.

Now, once the TreeView can actually be used, it's a common control - so
the code that calls into the imagelist APIs could be outside of the parts
we can see in .NET code. And this code would no longer be caught by the
.NET interop layer, either.

Finally, for the interop thing there's a special attribute called
SuppressUnmanagedCodeSecurityAttribute - guess what that one does... look
here (MSDN) for a discussion: http://shrinkster.com/8cx

And then, even more finally, nobody would keep you from implementing
similar functionality yourself, without using the imagelist API. This
would probably be a bit difficult as soon as you want the drag images to
be displayed while data is being dragged between controls (as opposed to
only above one control) - just the reason why MS chose to implement this
stuff in as unlikely a place as the imagelist API.

               Oliver Sturm