The Register: MS Security Patch Fails on Local Files

The MS patch intended to fix a data binding flaw in IE, which enables a script to call executables on your Windows machine using the object tag, does not protect against malicious files launched from a local directory.