if ( !empty($_GET[ 'r' ]) ) {
	$TFILE = realpath($FOLDER . "/" . $_GET[ 'r' ]);
	echo 'hrm '.$TFILE."=".$FOLDER.'<br />';
	if (strncmp($FOLDER,$TFILE,strlen($FOLDER)) != 0) {
		readfile($TFILE);
		die;
	} else {
		echo "<h1><b><u>NOPE</u></b></h1>";
		die;
	}
}

input, http://mepage/mytest.php?r=/readme.txt

outputs:
hrm c:\www\mytest\readme.txt=c:\www\mytest
<h1><b><u>NOPE</u></b></h1>