I can confirm this is reproducible with the current master branch (commit dba1cc1)

The output when running on the file using the config is:

FILE: reproductions/439.php
-----------------------------------------------------------------------------
FOUND 1 ERROR AFFECTING 1 LINE
-----------------------------------------------------------------------------
 10 | ERROR | The use of function join() is forbidden; use implode() instead
-----------------------------------------------------------------------------

Time: 47ms; Memory: 4MB

Debugging the violating token shows the information as shown below. Which doesn't seem to contain any information about the function namespace. Perhaps that is where the issue lies as adjusting the code the use the full qualified function name resolves the false positive. Should we perhaps look at the uses/imports and see if there is one that matches the function name. Also one last remark is that when using \join() (the native PHP versie with the root namespace of slash) it is correctly detected.

array(8) {
  'code' =>
  int(262)
  'type' =>
  string(8) "T_STRING"
  'content' =>
  string(4) "join"
  'line' =>
  int(10)
  'column' =>
  int(16)
  'length' =>
  int(4)
  'level' =>
  int(2)
  'conditions' =>
  array(2) {
    [14] =>
    int(333)
    [23] =>
    int(310)
  }
}