What paths are searched by start?  Is this path list queryable via WMI, the registry, WSH shell folder constants, .NET methods, or any other Windows API?
In a cmd console, the start command is sort of magic.  Say your default web browser is Firefox.  You also have Chrome and Opera installed, but they are neither set as default, nor associated with any file types, nor in your %PATH%.  Considering the following example:
start "" opera https://stackoverflow.com
... why does that work?
The reason this matters is that, for all the start command's strengths, it is still perilous to retrieve an application's PID or window handle when that application was launched with start.  In a cmd environment I'd prefer to use wmic process call create in a for /F loop to capture the PID.  So is there a way I can teach wmic process call create to launch "opera" or "iexplore" or "outlook" or "winword" or other applications as start can without fully qualifying the drive:\\path\\to\\executable?
I thought I was on to a solution by scanning HKLM\Software\Clients recursively for shell\open\command, then adding each referenced location temporarily to %PATH%:
rem // temp add installed clients to %PATH% to make "call :display" behave like "start"
setlocal enabledelayedexpansion
for %%a in (HKLM HKCU) do for /f "tokens=2*" %%I in (
    'REG QUERY %%a\Software\Clients /s /f command /k /ve ^| find "(Default)"'
) do if "%%~I"=="REG_EXPAND_SZ" (
    if /i "%%~xJ"==".exe" (
        if "!PATH:%%~J\..=!"=="!PATH!" path !PATH!;%%~J\..
    ) else for %%# in (%%J) do if /i "%%~x#"==".exe" (
        if "!PATH:%%~#\..=!"=="!PATH!" path !PATH!;%%~#\..
    )
) else (
    if /i "%%~xJ"==".exe" (
        if "!PATH:%%~dpJ=!"=="!PATH!" path !PATH!;%%~dpJ
    ) else (
        for %%# in (%%J) do if /i "%%~x#"==".exe" (
            if "!PATH:%%~dp#=!"=="!PATH!" path !PATH!;%%~dp#
        )
    )
)
endlocal & path %PATH%
That works reasonably well, but it still falls short of what start can access.  For example:
start "" wordpad
works, whereas
wmic process call create "wordpad.exe"
fails.
