本地文件包含str_replace安全性

I am trying to write local file inclusion secured php file. I found a breakable solution in DVWA like that:

$file = str_replace( array( "..\\" ), "", $file );

Than I took a step forward and wrote this:

 $secure  = $_GET[ 'page' ];
 $secure = str_replace( array( ".", "\\" ), "", $secure );

 if (isset($secure)) 
 {        
   include($secure.'.php');         
 }

I couldn't break this security. Also I've never seen it used anywhere. Why nobody use this replacing trick for single dot and single backward slash?