Today there path the an episode is there in plain text, and you have to copy it and, for example, paste it in the Run-dialog (win+r) in windows, instead of just clicking it and getting basically the same functionality.
I can see there could be security issues involved here, so I would make a setting that is default on that limits this functionality to either the local host (127.0.0.1)(default) or optionally the local subnet, or completely off.
Note: the web server should NOT deliver the file, it should be assumed that the path is accessible by the client, else there would be to many security issues.