I think it is inadvisable to have the database point to a file in the filesystem
I understand what you're saying here (someone can change a file to be something you dont want it to be) regardless of the optimisations in a modern RDBMS it is generally considered a more scalable solution to put the images on the disk and a pointer in the db.
Of course if you've a low volume site that is lite on graphics, it may well be better to keep your graphics in a DB.
Unfort, i dont have any metrics handy to backup my claims here..:-(
