This is the output in my env that demonstrates how it works (forgive the hebrew chars):
~/.emacs.d$ ls -all
total 20
drwx------ 2 duke duke 4096 ספט 28 20:24 .
drwxr----- 105 duke duke 16384 ספט 28 14:36 ..
~/.emacs.d$ echo '(let ((default-directory "/opt/")) (shell-command "touch stub.file"))' > init.el
~/.emacs.d$ ls -all /opt/ | grep stub.file
~/.emacs.d$ sudo emacs
~/.emacs.d$ ls -all /opt/ | grep stub.file
-rw-r--r-- 1 root root 0 ספט 28 20:25 stub.file
~/.emacs.d$ rm /opt/stub.file
rm: remove write-protected regular empty file ‘/opt/stub.file’? yes
rm: cannot remove ‘/opt/stub.file’: Permission denied
~/.emacs.d$ sudo rm /opt/stub.file
~/.emacs.d$ ls -all /opt/ | grep stub.file
duke@nukem:~/.emacs.d$ sudo ls -all /root/.emacs
ls: cannot access /root/.emacs: No such file or directory
Tested and works as well on Ubuntu 16.04 with emacs24.