The filtering method is unsafe on windows as
..\ won't get replaced. Also you'll be able to include files from sub directories such as
Wrappers won't work as the
./ path prefix isn't compatible with any of the wrapper URIs.
Exploitation of this would likely require multiple steps, f.ex writing php into a file in the same directory or a sub directory using file upload, csv export, temporary logs, etc.
You could also leak the content of non php files which might get you additional information to use against other parts of the application such as .htpasswd file for an admin interface, like:
admin/sql_dump.sql to be able to access additional functionality which may contain additional vulnerabilites.