Well, I'd do lots of checks on both filenames: make sure they aren't absolute, have no ..'s in them, or funny chars. Ie be as paranoid as possible.

Dave.