[scott_karana]

For a while, browsers allowed unfettered Javascript access to local files, so malware sites would just get users to save the site, and run it.

Tada, access to local files, or unlimited XHR requests for DDoSing, etc. :-)