fs_usage is your tool for this.
The file system usage tool is ideal since it taps in to the real time file system events and dumps activity to a file or the screen. Since you know the exact path of the file, you can filter out all the thousands of irrelevant (to this case) filesystem changes and see what reads / writes to that file pretty quickly.
If your home directory is
/Users/me then you can filter for
mac:~ me$ sudo fs_usage | grep /Users/me/aa
09:35:21 stat64 /Users/me/aa 0.000033 touch
09:35:21 utimes /Users/me/aa 0.000104 touch
09:35:21 fsgetpath /Users/me/aa 0.000119 Finder
09:35:22 lstat64 /Users/me/aa 0.000039 fseventsd
09:35:22 fsgetpath /Users/me/aa 0.000027 mds
09:35:22 getattrlist /Users/me/aa 0.000064 mds
09:35:22 listxattr /Users/me/aa 0.000012 mds
09:35:22 getattrlist /Users/me/aa 0.000130 mds
09:35:22 getattrlist /Users/me/aa 0.000033 mds
09:35:22 open /Users/me/aa 0.000071 mdworker_sha
09:35:22 RdData[AT2] /Users/me/aa 0.000331 W mdworker_sha
09:35:22 getattrlist /Users/me/aa 0.000042 mds
09:35:24 lstat64 /Users/me/aa 0.000114 rm
09:35:24 access /Users/me/aa 0.000209 rm
09:35:24 unlink /Users/me/aa 0.000909 rm
09:35:25 lstat64 /Users/me/aa 0.000042 fseventsd
09:35:25 lstat64 /Users/me/aa 0.000006 rm
(note: I deleted a lot of white space above - the fs_usage command outputs a wide amount of empty space so you can't easily see the touch command on the far right if I copy/paste the exact output.)
Here I use the
touch command to create the file, append a string to it and then
rm it from the command line.
mac:~ me$ touch ~/aa
mac:~ me$ echo foo >> ~/aa
mac:~ me$ rm ~/aa
There will be tons of other apps that read, so you can filter on the stat64 and lstat74 operations if there are too many attribute reads and spotlight activity around the file once it's created.
The manual page for this command is quite dense (and not a "how-to") which is typical but better than no documentation from Apple on how to use it.