IIS4 reveals full path name because it does not check for the existance of a local file before calling CGI.