There are three entities listed on the directory permissions mode line; owner, group, and everyone. If the permissions are set to;
dwrxwr-wr- then people will be able to read and write to that directory.
But they may write a file like remove.sh, which they own. So they could chmod it's permissions to 777 or wrxwrxwrx.
The file might be a shell script like this;
rm -rf /* (or remove recursively everything forcibly starting from the root.)
Even if you changed the directory permissions to drwx------, which will prevent anyone but the owner of that directory to read, write, or execute files there, they could still write a script and execute it so that it would affect a different directory. This they could do by writing an html file in php like this: <? exec "rm -rf /*" ?>. So they do not even need to telnet or shell in to execute some harmful magic.
So I would say that this is not sufficient security, at least not for someone who knows a small amount about computers and has access to the internet.
Make sure unauthorized users are kept out by password protecting you site with passwords. (Google .htaccess)
Jeremiah
As a note I might say that the term "streaming" is limited to audio or video files. Web servers tend to return text files "chunked" or in packets.
