The "not allowed" should be clarified.  What is meant is that if allow_fragments is false, a fragment is parsed as part of the path.

This doesn't make a difference for urljoin if the fragment is part of the second part.  It does make a difference for the first part:

>>> urljoin('http://www.example.com/#frag/', 'foo#bar', allow_fragments=True)
'http://www.example.com/foo#bar'

>>> urljoin('http://www.example.com/#frag/', 'foo#bar', allow_fragments=False)
'http://www.example.com/#frag/foo#bar'

For reference, the urlparse() results:

>>> urlparse('http://www.example.com/#frag/', allow_fragments=True)
ParseResult(scheme='http', netloc='www.example.com', path='/', params='', query='', fragment='frag/')

>>> urlparse('http://www.example.com/#frag/', allow_fragments=False)
ParseResult(scheme='http', netloc='www.example.com', path='/#frag/', params='', query='', fragment='')