If host msdfs = yes and flags2 has FLAGS2_RESOLVE_PATHS_IN_DFS and the below 
config is used listing any subdirectory of the tmp share (which is not in dfs) 
lists the contents of tmp itself. The subdirectory does not need to exist. I 
can only trigger this bug using jCIFS as smbclient does not appear to support 
DFS and NT 4.0 must be performing some extra steps that triggers the DFS path 
resolution code to perform differently because NT 4.0 lists the contents of 
tmp/test1 in the example below properly. Smbclient does not appear to support 
DFS but you might be able to trigger the bug if you simply flip on 
FLAGS2_RESOLVE_PATHS_IN_DFS. Or when 0.8 of jCIFS is released you can run the 
examples/ListFiles program like:

$ java -Djcifs.properties=../miallen.prp ListFiles smb://miallen3/tmp/test1/
 mlx.out nfs_snoop.txt orbit-root/ Xprt.out xterm-pipeuWAZNq xterm-pipe80ibGf 
orbit-mia ...

Protocol Info
wins              NBNS     Name query NB MIALLEN3       <20>     
NBNS     Name query response NB 172.23.22.134
TCP      37300 > netbios-ssn [SYN] Seq=2614003484 Ack=0 Win=32767 Len=0
TCP      netbios-ssn > 37300 [SYN, ACK] Seq=2603255275 Ack=2614003485 Win=12288 
Len=0
TCP      37300 > netbios-ssn [ACK] Seq=2614003485 Ack=2603255276 Win=32767 Len=0
NBSS     Session request
TCP      netbios-ssn > 37300 [ACK] Seq=2603255276 Ack=2614003557 Win=12216 Len=0
NBSS     Positive session response
TCP      37300 > netbios-ssn [ACK] Seq=2614003557 Ack=2603255280 Win=32767 Len=0
SMB      Negotiate Protocol Request
SMB      Negotiate Protocol Response
TCP      37300 > netbios-ssn [ACK] Seq=2614003608 Ack=2603255369 Win=32767 Len=0
SMB      Tree Connect AndX Request, Path: \\MIALLEN3\TMP
SMB      Tree Connect AndX Response
TCP      37300 > netbios-ssn [ACK] Seq=2614003779 Ack=2603255458 Win=32767 Len=0
SMB      Transaction2 Request FIND_FIRST2, Pattern: \test1\*     
>>>>HERE<<<<
SMB      Transaction2 Response FIND_FIRST2, Files: . .. mlx.out nfs_snoop.txt 
orbit-root Xprt.out xterm-pipeuWAZNq xterm-pipe80ibGf orbit-miallen xterm-
pipeEJXUAv xterm-pipeZK9RsV
SMB      Transaction2 Request FIND_NEXT2, Continue: xterm-pipeZK9RsV
SMB      Transaction2 Request FIND_NEXT2, Continue: xterm-pipeZK9RsV
SMB      Transaction2 Request FIND_NEXT2, Continue: nfs_snoop.diff
SMB      Transaction2 Response FIND_NEXT2, Files: firstcall.html multexnet.html 
themarkets.html xterm-pipebJEQ8d xterm-pipewoXm3O xterm-pipeCzbijp xterm-
pipeLa3Et6 xterm-pipeHpKifp xterm-pipeGRcxMu xterm-pipepXW40V
SMB      Transaction2 Request FIND_NEXT2, Continue: xterm-pipepXW40V
SMB      Transaction2 Response FIND_NEXT2, Files: xterm-pipeIdGfHE xterm-
pipexTTonM xterm-pipeGNKrsV xterm-pipeHhGqdg xterm-pipe7vkaWm xterm-pipeMxffza 
xterm-pipePbzBWz rdiff-backup-0.12.5 rdiff-backup-0.12.5.tar.gz orbit-wruser
SMB      Transaction2 Request FIND_NEXT2, Continue: orbit-wruser 
SMB      Transaction2 Response FIND_NEXT2, Files: samba-2.2.8a-2_rh73.i386.rpm 
test1 etherXXXXd4MQKj etherXXXXsnYhHg
SMB      Find Close2 Request
SMB      Find Close2 Response
TCP      37300 > netbios-ssn [FIN, ACK] Seq=2614004301 Ack=2603260889 Win=32767 
Len=0
TCP      netbios-ssn > 37300 [FIN, ACK] Seq=2603260889 Ack=2614004302 Win=12216 
Len=0
TCP      37300 > netbios-ssn [ACK] Seq=2614004302 Ack=2603260890 Win=32767 Len=0

[global]
   ...
   host msdfs = yes

[dfs]
   comment = Public Stuff
   path = /home/miallen/tmp/dfs
   public = yes
   writable = yes
   printable = no
   msdfs root = yes