I believe this behavior matches the documentation:

  "If the pattern is followed by an os.sep, only directories and subdirectories match."

('the pattern' being '**')

I wonder if '***.pacnew' would work.