Any reason not to use a full-on `_.escape()` here instead?  I assume a "&" in the filename would break it just as badly...