The only problam with this is $filename ...
It gives you the path as well, so it's depends on the user's setup.
It seams that a filename longer then 250 crashes mIRC, so I've taken only the filename itself (as it is in the ctcp) and checked it.
I've did some testing with this snippet, and it works fine:
ctcp *:dcc send *:*: {
if ($chr(34) isin $3-) var %file = $+(",$gettok($3-,1,34),")
else var %file = $3
if ($len(%file) >= 250) {
linesep
Echo -ts $+(,$colour(info)) $nick $+(,$colour(highlight)) tried to send you an exploit file to crash your mIRC !
Echo -ts Stoping send connection!
linesep
halt
}
}