As you say, we'll fix this gaping security hole with arbitrary file reads later. But maybe we should put a # HOLY CRAP SECURITY HOLE there for the 5 minutes it exists. :-)