I too have been fighting this and I'm happy to report that the above recipe will work! (well almost... :)
The steps I followed are these:
1 - created a new database (as a quick way to get a clean db, may need to logout/login to have new database shown on the control panel)
2 - Using Webfiles created an xfer directory, uploaded the 4.3.5 install package to the xfer directory and unzipped it to the root. Renamed this directory to dnn.
3 - Using Webfiles Set permissions to give IUSR/Network Service full control
4 - Edit web.config and enter SiteSqlServer settings for your database. this was the only thing I changed in web.config.
5 - Using Webfiles create the dnn web application
6 - Launch the site and let the installer run. The only error I got was the reports module failed to install.
7 - I closed my browser and DID NOT access the new portal (don't know if this matters but that's what I did)
8 - Using Webfiles move all the directories/files in dnn up to the root (/)
8a (closed / reopend Webfiles to be sure it was refreshed again - don't know if this matters but that's what I did)
9 - Using Webfiles - delete the dnn web app and delete the /dnn directory (which should be empty by now anyway)
10 - Edit the site's alias in the PortalAlias table record to remove the /dnn - should only be www.domain.com in the field.
11 - Edit web.config and save it back to the website to force an app restart.
12 - STEP AWAY FROM THE KEYBOARD - don't try to access site for 10 minutes or so. (following FrankTs suggestion)
13 - I accessed my site and got an error. I edited web.config to set CustomErrors = Off and refreshed - found that it was trying to read the siteurls.config file from the root. I copied this file from /Config to root and refreshed.
14 - Voila - it worked!
As FrankT mentioned, there are problems with some modules that you'd need to deal with on any 4.3.5 install.
But I've added pages and modules and everything seems to be working and no FileIOPermissions errors.
Thanks for your great work, Frank! I was pretty close to opening an account somewhere else and it looks like I won't need to go thru that hassle now.
Toby