To be fair, this is a slightly different issue. External websites can presumably link to file:// or localhost URLs (the one in your comment works fine from the HN website), but they can't transmit any information about the resource back to their servers. That's also true of images (unless the server serving the image allows it via CORS).

An evil web page at example.com/evil can certainly contain an img tag for http://localhost/me.jpg or http://dropbox.com/private-photo.jpg. You will see your private images displayed on their web site, but while that may be disturbing (or even useful for phishing), the evil web page cannot transmit the image data back to itself. For example, it can't use JavaScript to load the image into a canvas, base64 encode the canvas, and POST it back to itself, because the canvas will become "dirty" as soon as the image is loaded into it, and the browser will not allow JavaScript code to dump a dirty canvas to any inspectable format.