The spec explicitly allows for browsers to reject paths which are too sensitive or dangerous, even if the user selects it. They explicitly list the entire Downloads directory as one such example (while also saying individual files from said directory are ok).