[+]: technically, it generates a new AES key, encrypts the message under it, encrypts that key under a key derived from ECDH over Curve25519 with the system public key (whose private key is encrypted and inaccessible while locked) and saves the encrypted file and the wrapped key somewhere to be decrypted when it gets unlocked and gets rid of the AES key.
This also only really works for software specifically designed for this mode.
EDIT: it can actually be mostly secure if the client public key is sent before locking and then the encryption is done by the server: the attacker would only learn the number and timing of new messages and their size (assuming an ad-hoc protocol and very carefully implemented software).
It's also sort of possible to do it with generic software by simply dumping HTTPS TCP traffic to disk and decoding it once the system is unlocked (although it allows a MITM to fill up your disk unless the ciphersuite allows authentication with a key that doesn't allow decryption).