Users are able to get the real filename of attachment

download/files.php uses 't' parameter to handle thumbnail output.
If you apply, say, 't=1' to the URL of an attachment which has no thumbnail (any non-image file really), you'll get an error like:
The file ./../files/thumb_279389_a6b20004e677bf2eeb23f337cf02c6ac does not exist.
Since thumbnail filename consists of the thumb_ prefix plus file's physical_filename, you'll get the real attachment filename as files/279389_a6b20004e677bf2eeb23f337cf02c6ac.