The "download behavior" in Internet Explorer 5 allows remote attackers to read arbitrary files via a server-side redirect.