I think you're right. Failing by not failing isn't intuitive.

I think we should fail in the case you mentioned, but also in the case where the to_file resolves to an illegal path (such as an ancestor path in safe mode). Basically, if we can't write, don't write it somewhere random and don't throw back the String.

I'll update accordingly if that sounds good to you.