TinyMCE popup windows using WP functions

In my editor I would like to use a TinyMCE generated popup to insert in the textarea some complex shortcodes. I use the TinyMCE API to show the popup (bottom of this question). The popup is a PHP file inside my theme. I would like:

1. To protect this file from external access (if ( ! defined( 'ABSPATH' ) ) does not work).
2. Use some WP functions inside this popup.

Which is the way you could suggest?

TinyMCE API call

init : function(ed, url) {
        // Register the command so that it can be invoked by using tinyMCE.activeEditor.execCommand('mcecax_webnews');
        ed.addCommand('mcecax_webnews', function() {
                ed.windowManager.open({
                        file : url + '/dialog.php',
                        width : 650 + ed.getLang('cax_webnews.delta_width', 0),
                        height : 500 + ed.getLang('cax_webnews.delta_height', 0),
                        inline : 1
                }, {
                        plugin_url : url, // Plugin absolute URL
                        some_custom_arg : 'custom arg' // Custom argument
                });
        });
[...] CUTTED

The popup of a TinyMCE is outside WordPress. You must include the wp-load.php, same handle like outside the WordPress install.

But think about this solution and maybe it is cleaner, that you create your data in a json string and handle this data in the popup. It is helpful to reads this post about the include od wp-load.php.

Here you find a Gist with a example to write a TinyMCE popup dialog in WordPress, without to include the wp-load.php. The author have also write a tutorial, but only in German language.

Also the hint to this WPSE Question about a tutorial. This tutorial create the popup content only with javascript. Maybe more secure and the data for the handle will also communicate via js to the editor.