Example from php3.ini:

open_basedir = /home/www/test/no_such_dir

If there is no subdirectory named no_such_dir 
on the filesystem, one would except that PHP does not 
allow to open any files. But PHP allows to open files 
within /home/www/test.

In other words PHP uses the longest substring from 
open_basedir that represents a valid directory name.

This can cause security problem.

I did not test doc_root or other similar lines in php3.ini, 
that could suffer the same problem.