You can create these routes via ISAPI, but not via ASP.NET (i.e., writing your own .asxd and observe the same borked behavior)--hence why I know the bug's somewhere in ASP.NET proper. You're correct that my post as-written is off, though. I initially thought ASP.NET was hitting files even though I'd told it not to. After more investigation, I think it's blocking those routes as a security feature to protect you in case you at some point turn file routing back on.