IE10: mhtml: Protocol Bypasses file:// Restriction and Loads Local Mark-of-the-Web Files

Since August 2011, internet-zoned pages are not allowed to use the file:// protocol. I found that prepending mhtml: to a file:// URL and loading it twice bypassed that restriction, loading local Mark-of-the-Web (MOTW) files from the filesystem into an iframe. The first navigation attempt produced no visible result; the second succeeded.

var filePath = "file:///c:/test/motw.html";
window.onload = function()
{
    window[0].location = "mhtml:" + filePath; // First time, it does not load.
    setTimeout('window[0].location = "mhtml:" + filePath', 100); // Second time, it loads the local file.
}

<iframe src="" width="600" height="160" scrolling="no"></iframe>

By setting the iframe location twice within a short setTimeout, the mhtml:file:///... URL was accepted on the second attempt, loading the local MOTW file into the iframe. This allowed an internet-zoned page to read local files that carried the Mark of the Web, bypassing the zone separation introduced after the August 2011 patch.

Found during my years at Microsoft (2006–2014). These bugs were patched long ago — shared here as a historical record for learning purposes.