By using javaasript in conjunction with shell:startup it's possible to place executable into startup folder if user drags an object on the page or scrolls the page.
vulners.com/securityvulns/securityvulns:doc:17407
vulners.com/securityvulns/securityvulns:doc:6658
vulners.com/securityvulns/securityvulns:doc:6659
vulners.com/securityvulns/securityvulns:doc:6660