During reply to a message with HTML file attached this file is saved to known location.
vulners.com/securityvulns/securityvulns:doc:6184
vulners.com/securityvulns/securityvulns:doc:6231