It's not you; it's me. My implementation of LoadScrap() (which is called at startup) is calling FSOpen(), and it turns out the glue code for that tries OpenDF() before falling back to PBOpen(). TIL.

The call is coming from within the OS!