I've written a micro-theme to show the bug in action and to show why NOW
arg is vital.  The following can be tested with "emacs -Q".

1. Put "test-bug-theme.el" (attached) in `custom-theme-directory' (or
another dir from `custom-theme-load-path')

2. M-x load-theme RET test-bug RET

After that `test-var1' and `test-var2' are still void (because
`custom--inhibit-theme-enable' is set to T in `load-theme').

3. Evaluate these 2 expressions:

    (defcustom test-var1 "red" "some doc")
    (defvar test-var2 "red")

`test-var1' is "blue" now and `test-var2' is "red".  That's why NOW is
so necessary: a theme can set an undefined variable which will be
defined with `defvar' only using NOW arg.