Another idea would be to patch the kernel (or glibc), and insert printk()-statements where the kernel opens a file... I think it's in ./fs/open.c in the Linux kernel.