The same with an absolute URL:

    <img src="jar:http://kaioa.com/b/0907/test.jar!/img1.png" alt="img1" width="32" height="32"/>

my security sense is tingling...