Prevents files outside the root from being detected.
Fixed remove bug when files not found.

Because $stat['realpath'] was being set, the empty($stat) check was always false after that.
Merge pull request #542 from Tuxion/2.x

Fixed 2 bugs. Local FS directory traversal and remove didn't notify when file not found.