diff --git a/Utils/SandboxBroker.m b/Utils/SandboxBroker.m
index 030bf422e..47a38e2e6 100644
--- a/Utils/SandboxBroker.m
+++ b/Utils/SandboxBroker.m
@@ -144,7 +144,7 @@ static SandboxBroker *kSharedSandboxBroker = nil;
 
 - (SandboxEntry *)recursivePathTest:(NSURL *)url {
 	for(SandboxEntry *entry in storage) {
-		if([SandboxBroker isPath:url aSubdirectoryOf:[NSURL fileURLWithPath:entry.path]]) {
+		if(entry.path && [SandboxBroker isPath:url aSubdirectoryOf:[NSURL fileURLWithPath:entry.path]]) {
 			entry.refCount += 1;
 			return entry;
 		}
@@ -162,11 +162,9 @@ static SandboxBroker *kSharedSandboxBroker = nil;
 
 	if(results && [results count] > 0) {
 		for(SandboxToken *token in results) {
-			if([SandboxBroker isPath:url aSubdirectoryOf:[NSURL fileURLWithPath:token.path]]) {
+			if(token.path && [SandboxBroker isPath:url aSubdirectoryOf:[NSURL fileURLWithPath:token.path]]) {
 				SandboxEntry *entry = [[SandboxEntry alloc] initWithToken:token];
 
-				[storage addObject:entry];
-
 				BOOL isStale;
 				NSError *err = nil;
 				NSURL *secureUrl = [NSURL URLByResolvingBookmarkData:token.bookmark options:NSURLBookmarkResolutionWithSecurityScope relativeToURL:nil bookmarkDataIsStale:&isStale error:&err];
@@ -177,6 +175,8 @@ static SandboxBroker *kSharedSandboxBroker = nil;
 
 				entry.secureUrl = secureUrl;
 
+				[storage addObject:entry];
+
 				[secureUrl startAccessingSecurityScopedResource];
 
 				return entry;