Location: URL: HTTP header in conjuection with ms-its: handler allows to save file to known location. Crossite scripting with modal dialogs.
vulners.com/securityvulns/securityvulns:doc:6308
vulners.com/securityvulns/securityvulns:doc:6345