instead of lsof, fs_usage or ps use the DTrace based opensnoop

For example watch which files are touched by Safari when your browsing through the web with the -n switch for filtering process names: sudo opensnoop -n Safari

Or which process is accessing /etc/passwd? Use the -f switch for file based filtering: sudo opensnoop -f /etc/passwd

This handy script comes with every OS X since 10.5 Leopard.