Why are double-periods (“..”) invalid in a WordPress image filename?

ms-files.php contains the following code fragment:

$file = rtrim( BLOGUPLOADDIR, '/' ) . '/' . str_replace( '..', '', $_GET[ 'file' ] );
if ( !is_file( $file ) ) {
    status_header( 404 );
    die( '404 — File not found.' );
}

This code determines whether or not the file can be found. However, it does something that I find… Odd. It removes all double-periods (“..”) from the string. Normally, this doesn’t matter, but we’ve had users upload files with two periods in a row (sigh), causing this portion of the code to incorrectly report code 404 (not found).

I’m tempted to remove the strange double-period-removing nature of this code, but I fear that I’ll inadvertently break something else. Why is this functionality present as it is coded?

Thanks! 🙂

Edit: To be clear, it would appear that double-periods are NOT invalid in WordPress, but they can’t be served up by this bit of code… So, they’re not invalid, but when accessed via this mechanism, 404 is incorrectly reported.