There is currently nothing in the spec[1] that prevents aria-controls from pointing to something that is hidden. Léonie said on Twitter:

If aria-controls points to something not in the DOM, how do you navigate to it?

Should aria-controls therefore be limited to elements that are visible?

[1] ARIA 1.1 specification