I could see an attack vector here based on file/directory names or the full path. Different inputs could lead to the same order of enumerated checksums.