Specifically, it blocks going higher than the handle, so using either absolute paths or paths with a ".." component.

Not sure if anything changes for symlinks.