It's possible for the 'imagesdir' attribute to be set from within a document, isn't it?  If so, this would probably need to be sanitized to make sure somebody can't go exploring for `/opt/root/private/sekrut/hidden/icons` directories and such via `attributes` hax0ring.