Looks safe enough, maybe add a shortcut check for URLs starting with //, http:// or https:// as these will never exist as files.