In practice it would be invalid to pick someone to whom you have not granted access to the site. Although the alert setting would be created, nothing would ever be sent to a user that has no rights to a site except for a notice that the alert was created.
People (site collection users) and profiles are not the same thing, but there is synchronization. If you add a user to a site and they were not previously in the site collection, they get added to people on that site collection and I’m not sure when their email address is looked up from the profiles (I think it depends – immediate if you send them a welcome email, and slightly delayed if you don’t).
If you try to set up an alert for someone who has not been previously added to a site collection (or for any other reason does not have an email address – like most administrator accounts, many temporary accounts, etc.) you will get the message (trapped error):
The following users do not have e-mail addresses specified: Username, David. Alerts have been created successfully but these users will not receive e-mail notifications until valid e-mail addresses have been provided
Set my e-mail address...
Troubleshoot issues with Windows SharePoint Services.
Where “Username, David” was my demo user. The “set my email address” won’t work for non-administrators and the “troubleshooting” won’t be much help, but the main part of the message is correct – the alert is created. If the user has a profile with an email address, the system will set it up in the background and the user WILL get alerts IF there is anything they can access (but clearly the user still needs access to the site). If you had previously added the user to your site, you don’t see this message after the email address has been synced.