Filemanager in normal form - security issue?

Hi, I hacked this together to be able to use the file manager in a normal form, but at the same time, this worries me a bit...what about security? If I can use this url to get into the filemanager (and upload files!) - wouldn't a hacker be able, too?

<script>
function SetUrl(link)
{
//alert(link);
txtBox = document.getElementById('file1');
txtBox.value=link;
}

function fileBrowser() {
URL ='http://10.44.11.20/crap/admin/fckeditor/editor/filemanager/browser/default/browser.html?Connector=connectors/php/connector.php&Command=GetFolders&Type=&CurrentFolder=/&ServerPath=/crap/resources/';
eval("page" = window.open(URL, '" + id + "', 'toolbar=0,scrollbars=0,location=0,statusbar=0,menubar=0,resizable=0,width=600,height=300');");
}

</script>
<form name='test'>
<input type='text' value='' name='file1' id='file1'>
<a href="javascript:fileBrowser();">open window</a>
</form>