This is a quite scary possibility. But true, it could have happened.
Same with US gold reserves. Germany keeps their Gold at New York Fed vault. It has not examined it's holdings in 30 years. Many claim that US may not even have German gold, but for as long as it say it does have it, Germany can say it owns 200+ tons of gold. It is actually may not be smart of them to demand to examine it. Because if they do and Gold is not there, Germany loses it's credibility. Funny thing, it is sometimes better for somebody just say that you have it rather than actually having it.
This absolutely can work, and has happened (or at least I suspect it has).
mtgox keeps all of its bitcoins in its wallet and not tied to any particular users. It maintains user account balances in its database. It has been hacked before and I suspect lost a portion of its assets while maintaining user account balances. It also may have had occasional theft, accounting errors, and perhaps some investment spending using bitcoins. So if user account balances total 1000 bitcoins, it is totally possible that mtgox only has some fraction of those bitcoins (and USD) available to pay out. I suspect that many new investors in bitcoins don't even have a wallet outside of mtgox as they are just in the speculation game, so it makes it even easier for mtgox to maintain a only a fraction of the balances of the accounts in its reserves.
Now, this doesn't mean that they are really doing this, but I have no reason to believe that they are not, and they are not the bastion of transparency. Heck, if they sold off 50% of their stockpile into cash right now, they would have a lot of fiat to work with, and it would be likely that users would never be the wiser. Maybe they could play even riskier and keep only 10% of the bitcoins.
What makes this possible scenario interesting is that this actually inflates the money supply. If there were only 1000 bitcoins in existence, and 500 were in gox balances, and gox spent 400 of them keeping 100 in reserve, there would be in effect 1400 bitcoins in circulation, even though there are only 1000 real bitcoins.
As someone on the sidelines I eagerly wait until there is a run on mtgox and keep a stockpile of popcorn on hand. Only then will we see what is going on in their backrooms.