The mod list on Windows would search the root of the drive if
fs_basepath, fs_homepath, fs_steampath, or fs_gogpath are blank ("")
(which is usually the case).
The issue is in the low-level Sys_ListFiles() but it only affects the
mod menu, on Windows. It cannot be abused by console commands to
list system files outside of the virtual filesystem.
---
If a directory at the root of the drive of the working directory
contained a pk3 file, the directory was listed in the mods menu. The
virtual filesystem doesn't add blank directory names to the search path
so it cannot load mods from the drive root. (Unless of course you set a
fs_*path cvar to "C:\".)
Sys_ListFiles() with blank directory caused Windows to use "\*" for the
search path and "\" prefix means root of drive. Unix opendir("") failed
so nothing was listed for blank directory.
Sys_ListFilteredFiles() with blank directory _and_ specifying subdirs
could access any directory (on Windows and Unix-like) but no code uses
this or makes it accessible.
These functions are only used for initializing the virtual filesystem
and listing mods. They are not accessible by anything else such as a
console command. Only the mods menu, on Windows, is affected.