This reminds me of the joke about the teenager who stands accused of killing his parents, and pleads for mercy from the court saying, "have mercy on me, your honor, I'm an orphan!"
http://www.eweek.com/article2/0,1759,1788600,00.asp?kc=ewnws042205dtx1k0000599 When the preview pane outputs the document's author name, it checks whether the name resembles an e-mail address; if so, it transforms it into a mailto: link in the pane. "The transformation into a link does not filter potentially dangerous characters and makes it possible to inject attributes into the link, which enables execution of arbitrary script commands," GreyMagic said. The company said script commands injected in this manner will execute as soon as the malicious file is selected in Windows Explorer and will be executed in a trusted context, which means they will have the ability to perform any action the currently logged-on user can perform "This includes reading, deleting and writing files, as well as executing arbitrary commands," GreyMagic said in its advisory. Microsoft criticized GreyMagic for publishing proof-of-concept code alongside its advisory, arguing that such a move could potentially harm computer users.
