Strange behavior with dir "../*.*" (Note the forward slash) - cmd

Question

Having the following folder structure:
A [Dir]
File.txt
B [Dir]
C [Dir]
Current working directory is at C
If I do
DIR "..\File.txt"
I get no files and that is expected since B is empty.
However if I do
DIR "../File.txt" --> Note the / instead of the \
I get the file at A !!!
If I do
DIR "../*.*"
I get the file at A and the dir output says the file is at B !!!
Here's the output of the DIR commands:
E:\a>dir
Directory of E:\a
2016-09-19 08:20 <DIR> .
2016-09-19 08:20 <DIR> ..
2016-09-19 08:20 5 File.txt
2016-09-19 08:19 <DIR> b
E:\a>cd b
E:\a\b>dir
Directory of E:\a\b
2016-09-19 08:19 <DIR> .
2016-09-19 08:19 <DIR> ..
2016-09-19 10:20 <DIR> c
E:\a\b>cd c
E:\a\b\c>dir
Directory of E:\a\b\c
2016-09-19 10:20 <DIR> .
2016-09-19 10:20 <DIR> ..
E:\a\b\c>dir "..\*.*"
Directory of E:\a\b
2016-09-19 08:19 <DIR> .
2016-09-19 08:19 <DIR> ..
2016-09-19 10:20 <DIR> c
E:\a\b\c>dir "../*.*"
Directory of E:\a\b
2016-09-19 08:20 <DIR> .
2016-09-19 08:20 <DIR> ..
2016-09-19 08:20 5 File.txt
2016-09-19 08:19 <DIR> b
Really strange. Is someone knowing what's happening?

Answer 1

Yes, there is an error in the dir tokenizer.
dir command will try to resolve the requested path+fileMask to a full directory path and then it will append the file mask (or asume a *) to enumerate the files inside the resolved path.
Curiously, the folder resolution has not any problem to determine what the starting folder should be (Directory of E:\a\b in your output), BUT the tokenizer has a problem removing the relative folder reference from the file mask when forward slashes are used.
The result is that once the folder is resolved to E:\a\b\ (correct), the full ../*.txt is appended (wrong part, the relative folder reference should have been separated from the file mask), and then E:\a\b\../*.txt is enumerated (that is, E:\a\*.txt) without any problem
Now, if we create a deeper hierarchy (E:\a\b\c\d), with d the current active directory, this behaviour can be tested by replacing the request to dir "../../*.txt". In this case, the starting folder will be resolved to
E:\a\b, but as the "../../*.txt" will be appended, at the end the root folder will be enumerated.
note: at this moment I don't have a debugger at hand to be 100% secure of this, but it has been tested running a cmd instance under Api Monitor and the api calls show the described behaviour.