Get Demo
Mozilla before 1.7 allows remote web servers to read arbitrary files via Javascript that sets the value of an tag.