It may take serious effort to determine if an application has significant unexpected or hidden functionality, and it could indicate deeper problems in the software development process. If the functionality isn't necessary to the purpose of the application, it should be removed, as it may have unknown impacts or dependencies that were not taken into account by the designer or the customer. (If the functionality is minor and low risk then no action may be necessary.) If not removed, information will be needed to determine risks and to determine any added testing needs or regression testing needs. Management should be made aware of any significant added risks as a result of the unexpected functionality.
Just kidding. Usually there is a distance between the requirements and the actual product that comes out of the dev bakery. Obviously the tester has to take into account the actual application to be tested. Bottom line - test the part without the requirements too and make sure it works!
Of course, find out if the extra functionality is intentional, and you may have your say how well it was developed.