Imagine this program was running within a chroot(2) that it didn't set up. You can nest a chroot(2) and break out -- that was the point I was making.
In your example, you would always need to acquire a file descriptor outside the current chroot first. Then such a file descriptor has to be passed over some mechanism into the process running in the chroot. For that, you would definitely need help from some other process running outside the chroot. Breaking out a chroot on Linux is not as trivial as you present it.
The attack is the following:
0. Process is running in a chroot.
1. Process opens a handle to ".".
2. Process chroot()s to a directory underneath ".".
3. Process chdirs to handle made in (1).
4. Process chdirs to ".." a bunch of times.
5. Process chroot()S to "." which is the host "/".
But it doesn't require another process to help you. Seriously, just try it.
The (attacker's) program is already running inside a chroot -- presumably because they got code execution from some chroot-ed process (after all, chroot is a layer of security right?).
The attacker opens a file handle to ".". They then chroot() to a subdirectory. Then they fchdir() relative to the file handle all the way to the host's root. Then they chroot() to the host root. They have now broken out of the original chroot(). I really don't think I can break it down any further.