CAR 262AM defines Limited category ops.
Yes you can fly CPL with no AOC as long as the aircraft has the approporiate CofA issued by the Warbirds Assoc. The limits to ops are listed in the CAR and include things like ops only returning to the same aerodrome, placards say "not CASA", "Own risk", etc. displayed all over the place, and no advertising as Joy or Scenic flights, and or course, only approporiately endorsed CPL pilots.
If it was Hemples that sold the flight then a good close look will have to be had at the operating procedures for the plane as registered with Warbirds as it is this document (kind of a mini AOC manual) that says who's responsible. If it says the Owner is responsible then the CP should be in the clear. If it says the CP or The Operator is responsible then...
Flog.