Or I just expose my malicious share to the Internet. No mounting step necessary.

file://<Evil-IP>/evil.js