Thanks, so looks like this was all about the ":" character producing unexpected behavior.
According to the CVE, the root cause is unexpected behavior in the JRE caused by inconsistent behavior in the Windows API.
It looks like they are using getCanonicalPath to ensure that the file is under the serving root but there is some behavior that confused the Tomcat code. I can imagine this bug could manifest in other software that depends on this behavior on Windows.