This was raised in the epubcheck tracker: w3c/epubcheck#1252 (comment)

We don't say anything about resolving a path that starts with a slash.

Is the root the root of the container or is it the location of the package document? If it's the former, the paths will be problematic for reading systems that serve unzipped content using the location of the package document as the root.

It seems like we should formally disallow root-relative paths unless we want to spec out the behaviour and are sure that all reading systems already do the same thing.