Why do I get a security exception when I use ".." in the path to try to get an image file?

The SecurityManager considers going up a level from the code / document base to be providing access to something that you shouldn't have access to. Thus:

getImage(getDocumentBase(), "../foo.jpg");