Ross, it's been a while since i've coded any php, but as I recall code string $chkmd5return = md5_file($chkfilename); being capable of being subverted.
I believe your correct in that PHP could not be used to attack this site, but I don't think it's a correct asssumption to assume that the users of the site
would be safe in clicking on the file.
Again, I've been out of it for sometime, so I may be very wrong but it may also be something to evaluate for you.
Regards,
Gerald