Not that I think we could break out of the directory since we use basename, but you never know... maybe there's a unicode bug in PHP or something.