The ATTACHMENTS FLDR site preference indicates where the application copies the report output to before showing it to the user. It is also the folder where BLOB file attachments are stored. 

It must be a directory that the [Application Server] process can access BUT should be secured from anyone else accessing.