This is a question as much as a suggestion.
Shouldn't Specification.ToString append the list of IFetchStrategy.IncludePaths?
The Specification.ToString is hashed and used for the cache key, which means the lack of includes in that key will return cached entities that lack the expected properties and cause an exception. I've just created my own MySpecification which does this already, but perhaps this should be included in the base class too?
It seems the intention may be that you implement your own FetchStrategy and the type name will become part of the cache key, but this seems limited given the wide variety of include scenarios.