Note that feh does not try to convert encodings or anything. It expects
filenames to be in UTF8 and passe them on to NET_WM_NAME and NET_WM_ICON NAME.
The only new thing is that it now also sets _NET_WM_NAME and _NET_WM_ICON_NAME
and explicitly tells X11 that they are in UTF-8. Again, no recode, if you use
UTF-8 filesystems (which you should), everything is fine.

This prevents a (highly unlikely) case of an attacker knowing feh's PID and
the user's URL rewriting user files by means of a TOCTTOU attack.

It is still possible to _create_ arbitrary files via dangling symlinks. That
will be fixed once I switch from wget to libcurl.

(cherry picked from commit 3bd5012d)