It appears that both default and custom "ErrorDocument 400" are not returning headers when handling the condition that returns "You're speaking plain HTTP to an SSL-enabled server port." I have replicated this when there is no ErrorDocument being set in the apache configuration.
This report is related to bug 50823 I created a while back: -- https://issues.apache.org/bugzilla/show_bug.cgi?id=50823
*** This bug has been marked as a duplicate of bug 50823 ***