Linux, too, sot of (Windows MS-DOS Device Name DoS vulnerabilities)
Using img src="file:///dev/tty0" on my Linux machine caused Netscape and Mozilla both to eat all the keyboard input. I had to use another machine to kill it. I expected Netscape to NOT open file URIs from within a page fetched via !file http, https, ftp, gopher, etc.. -jwb...