Really? Try it. I am sure, that this works. You can create directory in chroot and break chroot by this. fd is not closed, because linux doesn't close descriptors by chroot syscall. this can be done every time if you have CAP_SYS_CHROOT.This does not help. Let's try:
fd = open /
('fd' implicitly closed and chdir to /foo)
/../ => /
so you are in root.
so we remain in chroot.