[SECURITY] Fix arbitrary file disclosure in form extension

Resolves: #73459
Releases: 6.2
Security-Commit: ab36da69dbdf20e9940faf4ff7ead88657b9ed14
Security-Bulletins: TYPO3-CORE-SA-2016-009, 010, 011, 012
Change-Id: Ie9e38ee56c8df984653d4bab161087dd20cd065c
Reviewed-on: https://review.typo3.org/47595


Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
Tested-by: Oliver Hader <oliver.hader@typo3.org>