[chrisnolet]

Simulator instances aren't sandboxed, so you can transverse the master system's file system with a malicious iOS app. This is indeed an attack vector.

[shortstuffsushi]

Huh, indeed they are not. Was able to pull a file off my desktop through Safari. Was not aware of that.