That seems like an easily fixed bug.  The final path should be limited, not the unexpanded version.