inotifywait is intended for performant file monitoring such as what you are looking for. Here is a proof of concept:
$ inotifywait -qrm -e open -e access --format "%e %f" tmp/
The output comes from running
touch tmp/hello, followed by
less tmp/h<TAB> (which tab-completes to
less tmp/hello), followed by Enter to open the file with Less.
When run system wide, you will probably want to exclude places such as
/sys. You might also want to pipe it through
grep -vE '^(OPEN|ACCESS),ISDIR$ to exclude directories. Finally, you should also have a look at the caveat given for recursive monitoring:
Warning: If you use this option while watching the root directory of a large tree, it may take quite a while until all inotify watches are established, and events will not be received in this time. Also, since one inotify watch will be established per subdirectory, it is possible that the maximum amount of inotify watches per user will be reached. The default maximum is 8192; it can be increased by writing to /proc/sys/fs/inotify/max_user_watches.