We might want to document (a) what error cases are possible, and (b) what gets passed to the callback when the dialog is canceled.  Currently, I think it's never possible for err to be non-null... which could be confusing coupled with the ambiguity about cancel.  (This was a problem with the old open/save API docs too, though).