Use smb_open_sub() for the "mail" base too

This restores the ability for JS MsgBase() to be used to create the
initial mail message base properly, if needed.

This means that the 'subnum' should now be equal to scfg.total_subs
when referencing an arbitrary SMB via path (not in the configuration).