the reason that can be done is: the html file your viewing is on your computer and is nothing to worry aqbout. its not that your seeing your files on their computer. when you click on a link you doneload the html file onto your computer and your browser renders it inro the page you see.

what im trying to say is their goofing on you, nobody see those files but you because its all happening on your machine. just like typing c:\ into the address bar