The script just preloads every file in a hard-coded directory into an associative array and uses isset() to check if the requested post exists. So no arbitrary file access, either.