os.system("touch files/"+file)

Oops. What if my file is called " && rm -rf ~"?