#497 is about not assuming that `files[0]` is a file (and not a symlink).  not sure exactly when that comes up, but this code is still vulnerable to that I think.  I made a comment in #497.  maybe he can explain more when it happens.