Nice idea, but what happens if a user passes a malicious script that (for sake of argument) deletes everything in the root directory?

You do need to be logged on as root or admin to achieve this but as you're not checking any sort of permissions (that I can see) if a user can access root then this could be dangerous.

I don't have any bluetooth palms to test, but I'm guessing the host Macs need to pair with devices (as they do with mice/keyboards) before accepting incoming files. If so, this presents the same risks (low for most situations) as a bluetooth keyboard. Potentially someone could sneak into your office to pair a keyboard, then later hide in your closet and type commands.

There's no need to pair a device to receive files from it.
Once I left a picture I had on the mobile into every PowerBook at an Apple store!