It's possible to use about:\\ and res:\\ URl to execute javascript in context of any page and local machine.
vulners.com/securityvulns/securityvulns:doc:2112
vulners.com/securityvulns/securityvulns:doc:2159
vulners.com/securityvulns/securityvulns:doc:2160
vulners.com/securityvulns/securityvulns:doc:2187
vulners.com/securityvulns/securityvulns:doc:2781
vulners.com/securityvulns/securityvulns:doc:2795