Since I tried the XBAP (which didn't work because of mimetypes) I found that FA only checks the file extension of the submission file to reject bad files. So this is just an .exe renamed to a .png to get around that. I'm going to see how it behaves with the Download link.

Update: It's still a save-and-rename sort of deal, but at least I've removed the extraction step at the expense of a valid image on fullview. Maybe a bootstrap application that works with my crude FA library is in order? It would also add an extra layer of security too.