Might test for some combo of letting you reach files you shouldn't be able to, and other dangerously-configured httpd rules (e.g. open redirects), in such a way

Might test for some combo of letting you reach files you shouldn't be able to, and other dangerously-configured httpd rules (e.g. open redirects), in such a way that it lets the webserver take care of the whole request while still verifying you could access the file you want with a different request. Might help evade early detection by IDS or something, in very-specific cases, while still permitting probing of the filesystem. Like, it might let you basically stat the file without reading its contents, if the webserver does things in the following order: 1) Verify that the file, after applying rewrite rules, exists and is readable; else, 404, 2) see the "redirect" query string, short-circuit request and serve a 304 (or what have you) without actually reading the file we already verified exists—never actually make any syscalls to read the file. ... if it's not that, yeah, no clue.