[CleanCoder]

If it required JS it would not be a bug in Windows HTML component.

[chmod775]

It's a bug in Trident/MSHTML, which includes a 'JScript' engine.

Anecdotally code execution exploits in pure HTML (that don't require JS) are exceedingly rare, so it is unlikely it doesn't use JS.