> Explorer sets the current directory of the program to the directory containing the thing that you double-clicked
I found the linked article to informative and confirming my suspicion: "The thing that you clicked" doesn't have to be the executable - it could also be a document with the executable registered as launch handler, in which case the current directory will be the directory of the document.
Would be interesting to know how links and items in shell namespaces are handled.
Yup. And since applications load DLLs from their working directory by default, and opening a document sets the working directory... you'd better make sure you never open a document from an untrusted folder.
Applications don't load from the working directory first by default.
But they do load from the working directory by default [0] and until XP SP2 they put it before system32 in the search order [1] by default.
[0] https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic...
[1] https://learn.microsoft.com/en-us/windows/win32/dlls/dynamic...
The first link shows it loads from the folder of the application before the working directory even when the safe default is disabled.