I could probably list dozens of tables that do direct filesystem reads. There are also likely tables that parse user-controllable data that doesn't come directly from the filesystem.