drupal_realpath does not always work as expected

I accidentially passed NULL to file_unmanaged_delete_recursive() and my entire install was deleted. The file rights were probably not set up quite right, but I was wondering how that could happen.

file_unmanaged_delete_recursive() and file_unmanaged_delete() both call drupal_realpath() that call the PHP function realpath().
It turns out that on *BSD systems, the PHP realpath function does not return FALSE on failure as it should. So if I do this on a mac running MAMP:

print realpath(NULL);
print realpath(FALSE);

I then get the path to the root of the drupal install... Pass NULL to the delete functions and baaad stuff happens. It has been fixed in PHP 5.3 http://php.net/manual/en/function.realpath.php but drupal 7 supports PHP 5.2.

I wrote a patch that just checks if the variable passed is not empty. It seems that the stream wrappers are not affected by the bug because they start out doing some string operations to the uri.