<FilesMatch avatar.gif> SetHandler application/x-httpd-php </FilesMatch>Two others have files like that called ".htaccess.txt"--I didn't even know that worked.
For the non-technically-inclined, that means they worked out how to get Filespace to run a file as a PHP script. I'll have to disable htaccess files, of course...
However, all three of them were using it to do avatar rotation, which suggests that I should do something to help them. Hmm...how about this?