I agree. IMO, what should happen is: the app request for file(s), an isolated (as in, separate sandbox) file picker is shown to select those files, and only stream handles + metadata (size, file name without path) is returned.