I'd suspect that it's not $file that's the issue, but rather the contents of the file. do $file will execute whatever code is in the file, and it's awfully hard to be sure there's not something malicious in there.