http://forum.mikrotik.com/download/file.php?mode=view&id=26899
In the picture is not limited to the pppoe-out1 firewall, but why the failure of the rules.
If I remember correctly, this is logical bug in RouterOS. It doesn’t like unknown/inactive interfaces as condition. It makes sense when there’s no negation, because in that case it really doesn’t know what to do with it and such rule can’t match anything. But when negated, unknown/inactive interface should match any other existing interface. Unfortunately, RouterOS fails to see it that way.
You can use workaround with two rules:
/ip firewall filter
add action=accept chain=forward dst-address=113.91.135.x out-interface=pppoe-out1
add action=drop chain=forward dst-address=113.91.135.x
This is indeed a good solution, but I hope the official can help solve the BUG.
This is not a BUG. The rule will be invalid if you are using an inactive interface as a matcher.
Once the interface is active, then the rule will be valid.
I changed the picture to make it easier to see. The firewall rules refer to interfaces other than pppoe-out1.
The problem with this is that it’s not intuitive or expected behaviour. At all.
Condition out-interface=!xxx clearly says “not interface xxx”. The fact that “xxx” is inactive or unknown should not matter. If RouterOS sees that out-interface for packet is e.g. “abc”, it is without any doubt “not interface xxx”.
Hear Hear! 
It’s clearly a logical usability bug. I was suffering the same problem not long time ago and this “awkwardness” is quite poorly documented as well (to be very diplomatic). It’s even harder to spot the problem if the interface is a part of an interface list.