Oh, I just checked my Entitlements file and the app is sandboxed, and "com.apple.security.files.user-selected.read-write" is set to YES.