attacker's goal is to execute code, then the code is not executed until the function
returns at line 10 (assuming fname is allocated on the stack and there are no external
protection mechanisms).
For a path traversal (CWE-22) attack, the interaction point is the assignment to ftype at