I created a world with the name "../" without the quotes.

what happened: The world files were saved under /mnt/games/com.mojang/

what I expected to happen: the world filed would be saved under /mnt/games/com.mojang/minecraftWorlds/SOMETHING where SOMETHING is some folder name used when you name your world something that uses impermissible file name characters.

This bug does not appear to be a security flaw/risk because MCPE gives a "can't open world" if you try to make a world that writes to a place you can't access.

Also, after quiting to the menu, this world will never appear in the world list because it's not in the right folder.

Device is Samsung Galaxy S4 android 4.4.2 running MCPE 0.10.5.