If you want to display a file that lives outside your web document tree, then you'll have to write a program that reads the file from the filesystem and writes it to STDOUT. Something like this:

#!/usr/bin/perl -wT

use strict;
use CGI qw(header param);

my $file = param($file);

my $dir = '/path/to/pdf/files';

# Ensure that filename is _just_ a pdf filename
if ($file =~ /^(\w+\.pdf)$) {
  $file = $1;
} else {
  die "bad file name: $file\n";
}

print header(-type=>'application/pdf');

open(PDF, "$dir/$file") 
  or die "Can't open $dir/$file: $!\n";

binmode PDF;

my $buff;
while (read(PDF, $buff, 1024)) {
  print $buff;
}
[download]

Blessed Be
The Pixel