Not sure if OP is author, but if you are, just to inform you, there is a small typo in this paragraph:

"Unfortunately, none of tehse protections address the cost of matching a single path element of a single file name. In 2005, CVE-2005-0256 was issued for a DoS vulnerability in WU-FTPD 2.6.2, because it ran for a very long time finding even a single match during:"

Very informative article. Thanks for it!