from what i gather they pass the pipename into smb_probe_module which ends up calling dlopen

    status = smb_probe_module("rpc", pipename);

my guess is you can either pass in a pipename starting with / which will cause it to be treated absolutely or ../../ which will cause dlopen to do a relative lookup