CSS Aggregation: regexp mangles URL's in CSS

I turned on CSS aggregation for the first time, and all my background images in the theme disappeared!

Specifically,

body {
	background: #fff url(images/headerBg.gif) repeat-x 0 -20px;
}

was "compressed" into this:

body{background:#fff url(/sites/all/themes/images/headerBg.gif) repeat-x 0 -20px;}

On closer inspection, drupal somehow converted the url images/headerBg.gif into /sites/all/themes/zen/ew/images/headerBg.gif and then again into /sites/all/themes/images/headerBg.gif. It's the last transformation that was problematic.

After a bit of digging, the problematic code is includes/common.inc, in function _drupal_build_css_path, reproduced here:

/**
 * Helper function for drupal_build_css_cache().
 *
 * This function will prefix all paths within a CSS file.
 */
function _drupal_build_css_path($matches, $base = NULL) {
  static $_base;
  // Store base path for preg_replace_callback.
  if (isset($base)) {
    $_base = $base;
  }

  // Prefix with base and remove '../' segments where possible.
  $path = $_base . $matches[1];
  $last = '';
  while ($path != $last) {
    $last = $path;
    $path = preg_replace('`(^|/)(?!../)([^/]+)/../`', '$1', $path);
  }
  return 'url('. $path .')';
}

After a bit of experimentation, it turned out the regular expression is at fault. It forgets to escape the two periods with backslashes. Note that (?!../) refers to the look-ahead negative assertion as described here:
http://ca.php.net/manual/en/regexp.reference.php#regexp.reference.assert...

Because the periods aren't escaped, this regular expression replaces "/zen/ew" by "/". The obvious patch:

Index: includes/common.inc
===================================================================
--- includes/common.inc (revision 1348)
+++ includes/common.inc (working copy)
@@ -1810,7 +1810,7 @@
   $last = '';
   while ($path != $last) {
     $last = $path;
-    $path = preg_replace('`(^|/)(?!../)([^/]+)/../`', '$1', $path);
+    $path = preg_replace('`(^|/)(?!\.\./)([^/]+)/\.\./`', '$1', $path);
   }
   return 'url('. $path .')';
 }

The problematic code was introduced in the controversial path for this issue: http://drupal.org/node/113607
A comment by chx even suggested that instead of a regular expression, some php function (perhaps realpath?) should be used.
http://drupal.org/node/113607#comment-500017