Some additional points.
- The behaviour is different to the AGS 9.3.1 version. That version returned a blank image, not an exception.
- The provided solution says, that you have to build your own logic in your layercontrol. If no layer is checked you have fill the "show" attribute with the layer ID -1. I don't know if this is an appropriate workflow or if the server should behave differently.
- For a layer-control, you can ignore the grouplayers. They are not needed in the REST-request for the "show" parameter. The analog behaviour of ArcMap (grouplayer affects the visibility of sublayers) is not implemented in the REST API. It doesn't matter for the "show" parameter in the API if the group-layer is checked or not. Only the sublayer, which are not group-layers, count. The "hide" parameter behaves differently.
HTH and Regards.