/tmp $ PYTHONPATH='./test' /usr/bin/python -c 'import sys; print sys.path[:3]' ['', '/private/tmp/test', '/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python27.zip']
It's still odd for software to only work when launched from a specific directory, but not necessarily a critical security vulnerability then.