"One man's data is another man's code"

If this would happen on Windows you'd scream murder, yet in 2014 you are advocating an insecure workspace by allowing foreign control stuff to do out of bound stuff.

Anything and anyone can create a file which contains stuff, it is the responsibility of whatever views/reads it for what happens not the initial creator.

---
nginx for Windows http://nginx-win.ecsds.eu/