That is something we are all looking for ;) unless you are on the .200 or lower firmware, then there is an FTP traversal possibility. I have not found it yet, but according to the first post here it should exist. .
A guess that is untested, is that is has something to do with a symlink.... one that you create in your /ftp folder. Once created, the FTP client is able to follow that link outside the /ftp folder... (once again, untested, so not sure)