Can we create a core PHP file inside the files folder?
Files under that folder are writable by the web server. You could argue that makes it a security risk, but your server would already have to have been compromised in one way or another for it to become so. If your server is configured properly it will only execute PHP files, not serve them for plain-text download.

From the point of view of convention, though, you shouldn't do this. Putting code files all over the file structure makes maintainability infinitely harder.