Also, in 4.6.6.patch, there is nothing that addresses http://cvs.drupal.org/viewcvs/drupal/drupal/includes/file.inc?r1=1.39.2.12&r2=1.39.2.13, which is marked in CVS as a security issue.

Laura