When you say "doesn't match any of" I think of a hash rather than arrays; otherwise you're spending lots of runtime searching, when a hash would just hand it to you, O(1).

How about building a hash out of the pathnames, with the keys being the last part of the name, and the value being the path? That way, to get the ones that aren't in the safelist, you'd just look over the safelist and delete those keys. Anything left is not safe.

Would that work? It would certainly be faster.