Theme’s window.open call goes to “Page Not Found”

This is probably because you just should never directly access anything which is not JS, CSS or images on theme folders. Directly accessing PHP files in those folders is considered a security risk and people (me included) will block such an access at the server configuration level.

I assume that depending on the method used to hide the files, the webserver might not even be able to “see” that the file is there and will ask wordpress to resolve the URL which will end UP in a 404 page. But it doesn’t really matter why, just don’t write code like that.