When you combine with "DCIM" , you get a catastrophic privacy failure: A web-accessible, searchable list of someone's camera roll.