Hey James,
The problem really has to do with the limitations we're under when talking to a Git repository. Let me go into that and then I'll go into how that relates to what you're dealing with.
The reason that raw file URL field exists is because, with Git, it's not possible to request a given file at a given SHA. You can clone the whole repository, but that's not something Review Board can sanely do for every change.
So, what we do instead is we build a URL, based off the mask provided, that can give us the raw contents of a file, given a file path and a blob SHA1.
We need this so that we have a source file to apply a patch on top of. Without that, we can't show a side-by-side diff.
Some services provide such a URL. GitWeb, for instance, has one. GitLab does not. For GitLab, we have to instead query their API to get the data we need. That requires such things as API tokens and other IDs, which Review Board has special code to deal with, but that only works when selecting GitLab as a hosting service.
Without either a selected (compatible) hosting service or a suitable Raw File URL, we just have no ability to get the data needed in order to render a change consistently.
If you have such a URL but without the field for the SHA, and you're only ever dealing with reviewing changes on top of the very latest revision in the repository, it will work, but that's going to fail the very moment someone puts something up for review that is based on an older commit (and this will happen in real usage all the time), or on top of a commit in a branch other than 'master'.
Now, as for the analysis you've done, and the need for a third file, the reason this is at all a problem is because you don't have the above setup, so you're having to play games with your repository in a way that just doesn't work.
If you did have such a setup, what you'd do is generate a diff between the latest upstream commit and the commit just before the one you want to post for review. That diff may cover a whole number of commits, but it doesn't matter. That's the "parent diff." Once we fetch the proper source file from the repository (using the hosting service or the raw file URL), we apply the parent diff, and treat that as the base for the diff being reviewed. Then, we apply the diff representing the commit(s) you want to actually review.
RBTools takes care of all this automatically, letting you just do:
$ rbt post <mysha>
Christian