Confusion:
Are you saying that ffmpeg doesn't detect file by extension?
or
Are you saying that ffmpeg won't execute the malicious code if it's found appended to a valid video?
Reply on news.ycombinator.com