You haven't said which version you're encountering this on, but Gordon Linoff reproduced on SQL Fiddle which is running 11.2.0.2, and as others have said it's not seen in 10g and 11.2.0.3, so it seems reasonable to think you might be on 11.2.0.2 as well.
In which case, this looks identical to bug 12336962. If you have access to Oracle Support you (or your DBA) can look that up, but I can't reproduce what it says here, even though it's a published bug. Running your query and the example from the bug report produce the same results, and in both cases changing from union all
to union
produces correct results. You might want to raise a service request to get that confirmed though.
That bug is fixed in the 11.2.0.3 patch set - I'm not sure I'm really supposed to even share that, but it's already published here - so patching up might be your best bet, and Oracle might suggest that if you do raise an SR. If in doubt, ask Oracle directly.