This turned out to be a permissions issue. It seems that in order for ‘./your_filename.php’ to work, the user PHP is running as needs to have ‘List folder contents’ permissions on the folder – even though the file is directly specified.
In the end, the full solution involved turning Fast CGI impersonation off, getting PHP to run as the Application Pool identity and giving that more access to the wordpress folder.
There was some information on this in a question on SO – I can’t seem to find it now but will link to it in my answer if I come across it again.