It's possible to retrieve any file from client computer via URLMON and Dynamic OBJECT tag.
vulners.com/securityvulns/securityvulns:doc:23149