Assume the parameter is "mike.txt". Then the regex will match for .txt, but fail for .htm and .html, so the error will get printed twice.

If the parameter doesn't match any of those patterns, the error gets printed 3 times.

You're also not checking to make sure the extension is at the end of the filename, so that would match "miketxt.exe" as well, since /.txt/ is "any character, followed by 'txt'".

Please check out this discouraging webpage to get some other ideas of ways your script could possibly be abused...
--
Mike