>>647509If someone uploads a filename with some weird emojis, spaces, and other characters, storing that on disk, in a mysql database, interacting with it with code, and generating a link from that all becomes harder, although not impossible. I wouldn't want the server to be full of thousands of user-generated filenames either.
I'm not a super hacker and don't know how this might happen, but it's a larger attack surface and more complex than just immediately sanitizing/standardizing the filenames.