[eluser]coolfactor[/eluser]
I subclassed the Router library and added a special "img" shortcut. Whenever a route beginning with /img/ was encounted, the Router would search for a corresponding image in a designated location, and then pass that back to the browser. It's slightly slower, but offers protection.
The Router determines the file is a JPEG image, sends the appropriate headers, and then fpassthru's the file.