I find it odd to think a web browser displaying a page from $some_remote_url would happily try to load an image from the local machine. Never mind the NTFS bug, this is one of those cases where the browser is out of bounds IMHO. The only time it should have access to the local file system is if the user is explicitly doing something like selecting a file to upload somewhere, or saving a downloaded file. I suppose if you're reading a locally stored .html file it should be able to grab other things like images. The ability to exploit this seems like lazyness on the part of browsers. They needed local file access for legitimate reasons and just opened it up.