The restriction is still in the spec. Java EE implementations differ in their enforcement of the Java SE level security permissions so the code might work in some cases but it wouldn't technically be portable. It's also risky to depend on the particular file system structure of a deployment environment, since there's no formal relationship between that and an application.
[Message sent by forum member 'ksak']
http://forums.java.net/jive/thread.jspa?messageID=397224