I would assume that if you modulate the same polarity twice (e.g. positive envelope amount on the filter's envelope generator + positive filter envelope amount via PolyMod), you get the effect of recursive modulation. If the envelope generator behaved strictly linear, this would make its response exponential (perceived as a somewhat snappier movement from one extreme to the other). However, negative amounts paired with positive amounts seem to neutralize the impact of the envelope generator on its desination (given, you dial in the same value).