opensnoop is my new favorite utility. It uses DTrace to show you all of the files that are being accessed on your system, you need to execute it with superuser privileges
sudo opensnoop
You can also watch what a particular process opens by passing in the PID:
sudo opensnoop -p PID
Or watch a particular file to see who's opening it
sudo opensnoop -f /etc/passwd
