Please note that this is a security warning. Using cURL, a website could redirect the script to something like file:///etc/passwd and mess with things around. To prevent this, whenever open_basedir is set cURL doesn't follow locations. You'll have to follow them manually, and manually check if all followed locations are safe as well.

This comment on php.net implements a sample implementation of that:
http://us2.php.net/manual/en/function.curl-setopt.php#102121