php fopen is safe here? is possible for anyone by pass the .txt

One of our client using this code, what are possible scenarios to hack this

<?php

$handle     =   fopen($_GET['filename'] . ".txt", 'wa');
fwrite($handle, $_GET['data']);
fclose($handle);