Assuming or magically guessing file extensions leads to all sorts of confusion attacks that could result in arbitrary code execution. I would go so far as to s

Assuming or magically guessing file extensions leads to all sorts of confusion attacks that could result in arbitrary code execution. I would go so far as to say an absolute path should be required.