Crashing instead of raising an exception or bubbling a return code sounds like a legitimate bug ticket IMO.

One reason I'm in favour of handling capabilities in the OS is so we can stop having trivial symlink traversal and /.. traversal bugs in path filters (or indeed more complex bugs in the face of FS-specific linking primitives).