I have the following Ceph FS (shown from kernel CephFS mount):
client:~/:[0]# ls -Rla /mnt/
/mnt/:
total 10240
drwxrwxrwx 1 ddiss suse        2 Jul 14 16:05 .
drwxr-xr-x 1 root  root      214 Jul 10 20:29 ..
-rwxr--r-- 1 ddiss suse 10485760 Jul 13 16:01 smb_upload
drwxr-xr-x 1 root  root        1 Jul 14 16:12 stuff

/mnt/stuff:
total 0
drwxr-xr-x 1 root  root 1 Jul 14 16:12 .
drwxrwxrwx 1 ddiss suse 2 Jul 14 16:05 ..
-rw-r--r-- 1 root  root 0 Jul 14 16:12 nested_file


My Samba share of the same filesystem is configured via:
[rootshare]
        path = /
        ceph: config_file = /etc/ceph/ceph.conf
        ceph: user_id = samba.server
        vfs objects = ceph
        read only = no

When using smbclient to dump the directory listing of share I see:
client:~/:[0]# smbclient -U ddiss //smbserver/rootshare
Domain=[CTDB-SERVER] OS=[] Server=[]
smb: \> ls
  .                                   D        0  Fri Jul 14 16:05:26 2017
  ..                                  D        0  Fri Jul 14 16:05:26 2017
  smb_upload                          A 10485760  Thu Jul 13 16:01:37 2017
  stuff                               D        0  Fri Jul 14 16:12:13 2017

                131381297152 blocks of size 1024. 131372830720 blocks available
smb: \> cd stuff\
smb: \stuff\> ls
NT_STATUS_NO_SUCH_FILE listing \stuff\*
smb: \stuff\> ls
NT_STATUS_OBJECT_PATH_NOT_FOUND listing \stuff\*
smb: \stuff\> cd ../
smb: \> ls
  .                                   D        0  Fri Jul 14 16:12:13 2017
  ..                                  D        0  Fri Jul 14 16:05:26 2017
  nested_file                         N        0  Fri Jul 14 16:12:13 2017

                131381297152 blocks of size 1024. 131372830720 blocks available


This broken behaviour is caused by the following logic:

 934 static int cephwrap_chdir(struct vfs_handle_struct *handle,
 935                         const struct smb_filename *smb_fname)
 936 {
 937         int result = -1;
 938         DBG_DEBUG("[CEPH] chdir(%p, %s)\n", handle, smb_fname->base_name);
 939         /*
 940          * If the path is just / use chdir because Ceph is below / and
 941          * cannot deal with changing directory above its mount point
 942          */
 943         if (!strcmp(smb_fname->base_name, "/")) {
 944                 return chdir(smb_fname->base_name);

                            ^^^^^---- This is changing the *local* FS working directory!!

 945         }
 946 
 947         result = ceph_chdir(handle->data, smb_fname->base_name);
 948         DBG_DEBUG("[CEPH] chdir(...) = %d\n", result);
 949         WRAP_RETURN(result);
 950 }

I don't know why the chdir() logic was added in the first place (even with the comment), but the test case above passes once cephwrap_chdir() is converted to a simple ceph_chdir() call.