The current implementation does neither include dotfiles nor dotdirectories, e.g. everything starting with a '.'. In comparision, Chrome's old webkitDirectory API does include these files. I think they should not be ommited!
This was a deliberate decision - see bug 1209924. If you want to try and convince the security guys to change their mind then feel free, but this doesn't block shipping.
Thanks. I strongly oppose any filename-based filtering as you might have guessed. I commented in the relevant bugs: https://bugzilla.mozilla.org/show_bug.cgi?id=1209924#c10 https://bugzilla.mozilla.org/show_bug.cgi?id=907707#c32