Thanks for the quick response.
1. Shame. It is a good product and I hope Ubnt add this feature to a new FW release. If I understood correctly, the hardware is capable of doing this - it's a software issue.
2. Probably, but if I accidently plug a PC that is not configured correctly, I may expose it to the VLAN2 and VLAN3 trafic, which I consider insecure. The intermediate switch is an option, but a little overkill for 2 PCs.
3. If I move the UAP to eth1, is it possible to bridge eth1 and the switch for VLAN1? That way I will avoid having different IP subnets for the eth1.1 and switch0.1. Or is "real" IP routing with separate IP subnets the only way to go?