Quoting is not enough, as that won't handle filenames beginning with dash correctly.