diff -urN gpxe-1.0.0/src/core/exec.c gpxe-1.0.0-expandfilename/src/core/exec.c
--- gpxe-1.0.0/src/core/exec.c	2010-02-02 11:12:44.000000000 -0500
+++ gpxe-1.0.0-expandfilename/src/core/exec.c	2010-05-20 21:28:43.000000000 -0400
@@ -94,7 +94,7 @@
  * The expanded command line is allocated with malloc() and the caller
  * must eventually free() it.
  */
-static char * expand_command ( const char *command ) {
+char * expand_command ( const char *command ) {
 	char *expcmd;
 	char *start;
 	char *end;
diff -urN gpxe-1.0.0/src/usr/autoboot.c gpxe-1.0.0-expandfilename/src/usr/autoboot.c
--- gpxe-1.0.0/src/usr/autoboot.c	2010-05-20 20:56:32.000000000 -0400
+++ gpxe-1.0.0-expandfilename/src/usr/autoboot.c	2010-05-20 21:31:49.000000000 -0400
@@ -32,6 +32,7 @@
 #include <usr/dhcpmgmt.h>
 #include <usr/imgmgmt.h>
 #include <usr/autoboot.h>
+char * expand_command ( const char *command );
 
 /** @file
  *
@@ -85,6 +86,8 @@
 		uri_encode ( filename, buf + strlen ( buf ),
 			     sizeof ( buf ) - strlen ( buf ), URI_PATH );
 		filename = buf;
+	} else { /* only support variable expansion in absolute paths to avoid stepping on buf size */
+		filename = expand_command(filename);
 	}
 
 	image = alloc_image();