Never trust user data!
<?php
    readfile($filename);
?>
Turning off register_globals doesn't make this any more secure. The script would instead look like this:

<?php
    readfile($HTTP_POST_VARS['filename']);
?>
The only way to secure something like this is to be really paranoid about cleaning user input. In this case if you really want the user to be able to specify a filename that gets used in any of PHP's file functions, do something like this:

<?php
    $doc_root = $HTTP_SERVER_VARS['DOCUMENT_ROOT'];
    $filename = realpath($filename);
    readfile($doc_root.$filename);
?>
You may also want to strip out any path and only take the filename component. An easy way to do that is to use the basename() function. Or perhaps check the extension of the file. You can get the extension using this code:

<?php
    $ext = substr($str,strrpos($str,'.'));
?>