temporary:// (and other STREAM_WRAPPERS_HIDDEN scheme) files appearing within Media module content

me too! anyone can help?

Another one

Media just reads all the files from the file_managed table. So if devel_themer is putting files there, that's what happening. I don't know why devel_themer is putting files there. Are they temporary or perm files? I think a change went in not to long ago to not show temporary files. So if this is happening, that could be the issue.

In that case this should transfer to devel_themer, I suppose.
I enabled Devel Themer, checked some blocks, disabled the Developer modules again, and after that came across about a dozen items like these in Media's content:
devel_themer_8901306524da8c6f572920

Edit: hm, I'm actually not sure if this belongs in Devel Themer's or Media's queue now, please move it back to Media if that's where it belongs.

I think there are two parts to this issue and the initial question belongs to Media:

As I understand a previous comment by Jacob, media should ignore temp items in the file_managed table. Apparently it does not ignore them because it finds all those temporary://devel_themer_9563682274da5aac5d27da items.

The question about why there are so many devel_themer_yxz files in this table is an issue with devel themer that should be asked over there

Agreed.... Media should ignore temp files in the table...

Correct. In #1031910: Media browser should not allow user to select a temporary file, we fixed it so that anything without FILE_STATUS_PERMANENT is hidden from the Media UI (see the patch there, just a modification to media_admin_list() and media_browser_list()).

In this issue, we need to fix those same two functions to also not return any file entities using a scheme with the STREAM_WRAPPERS_HIDDEN bit set.

Anyone feeling like delving into D7 entity query and stream wrapper internals and submitting a patch for this?

Upping to major, because while not a security vulnerability in itself, it could lead to one, if other modules are expecting a level of privacy with hidden schemes that this module isn't obeying.

RTBC'd by Alex, committed the attached: