I think they have changed it so that you can by now create files with forbidden names and an extension. But that's a somewhat recent change.
Also you could always create such names with the right APIs, so one application could create such files, but another can't delete them or open them.