[creatonez]

Firefox has a builtin PDF reader, PDF.js, that resides inside of the Javascript sandbox. In theory, it's as safe as loading a webpage.

[autoexec]

So not actually all that safe since sandbox escapes happen all the time. PDF.js has had many vulnerabilities as well