It appears most functions that accept path/filename args don't check open_basedir.  The following code needs to be added to many functions after the convert_to_string_ex function call:

if (php_check_open_basedir((*filename)->value.str.val)) RETURN_FALSE;

where 'filename' could of course change.

(this check is typically inserted before the safe_mode check since safe_mode is often not used because of it's limiting factor for ISPs)