Beyond the classes included in the API, there are a few other classes, some of which have even preceded the Reflection API, which provide some sort of reflection capabilities [metaXa and the Future of Reflection. Golm and Kleinoder].
Socket class, the
security manager bases its decision on the current execution stack
and the class loaders used to load the classes on the stack. In order
to know these, some amount of reflection takes place. For example,
the (protected) method getClassContext() returns the state of
the current execution stack as an array of Classes.
java.lang.ref (for
example, WeakReference) provide some sort of reflective abilities, in
terms of being able to analyze such information as memory
utilization. Looks scary.