diff --git a/babel/localedata.py b/babel/localedata.py

index 9308b5e..688af79 100644

--- a/babel/localedata.py

+++ b/babel/localedata.py

@@ -18,6 +18,9 @@

 """

 import os

+import re

+import sys

+

 import pickle

 try:

     import threading

@@ -31,7 +34,23 @@ __docformat__ = 'restructuredtext en'

 _cache = {}

 _cache_lock = threading.RLock()

 _dirname = os.path.join(os.path.dirname(__file__), 'localedata')

+_windows_reserved_name_re = re.compile("^(con|prn|aux|nul|com[0-9]|lpt[0-9])$", re.I)

+

+

+def resolve_locale_filename(name):

+    """

+    Resolve a locale identifier to a `.dat` path on disk.

+    """

+

+    # Clean up any possible relative paths.

+    name = os.path.basename(name)

+

+    # Ensure we're not left with one of the Windows reserved names.

+    if sys.platform == "win32" and _windows_reserved_name_re.match(os.path.splitext(name)[0]):

+        raise ValueError("Name %s is invalid on Windows" % name)

+    # Build the path.

+    return os.path.join(_dirname, '%s.dat' % name)

 def exists(name):

     """Check whether locale data is available for the given locale.

@@ -42,7 +61,7 @@ def exists(name):

     """

     if name in _cache:

         return True

-    return os.path.exists(os.path.join(_dirname, '%s.dat' % name))

+    return os.path.exists(resolve_locale_filename(name))

 def list():

@@ -85,6 +104,7 @@ def load(name, merge_inherited=True):

     :raise `IOError`: if no locale data file is found for the given locale

                       identifer, or one of the locales it inherits from

     """

+    name = os.path.basename(name)

     _cache_lock.acquire()

     try:

         data = _cache.get(name)

@@ -99,7 +119,7 @@ def load(name, merge_inherited=True):

                 else:

                     parent = '_'.join(parts[:-1])

                 data = load(parent).copy()

-            filename = os.path.join(_dirname, '%s.dat' % name)

+            filename = resolve_locale_filename(name)

             fileobj = open(filename, 'rb')

             try:

                 if name != 'root' and merge_inherited: