Being as confusing as possible actually seems like a really good tactic. Depending on the web server and frameworks installed, couldn't etc/shadow.php actually be a file in a common framework? Also, if I wanted to be extra obscure, "redirect=google.com" wouldn't actually do what you think it would. It's just a key and a value which could be used for who-knows-what internally.