Thanks, I appreciate that!
I just didn't know if there was a way for someone to upload a specific kind of file, know the URL of that file (in the attachments dir), and then find some way to run, execute, etc. that file that's sitting on the server.
So, taking what I'd see as a worst-case...