In this vulnerability, a malicious web site opens a window to the file system on the visiting user's computer, and displays a file there. It then navigates to a new window in its own domain - this navigation is also known as a redirect. Both of these actions are allowed. This would allow the web site to retrieve the contents of the file that was displayed. Only files that can be opened in a browser window.
Examples are .txt, .htm or .js files.
Examples of file types that cannot be opened in a browser window include .doc, .dat, .exe and other file types. Tags in HTML specify formatting commands. It depends on your web browsing habits. The key thing to remember is that you have to visit a malicious web site in order to be affected by it. Most people visit a small number of familiar, professionally-operated web sites, and it's unlikely that such a site would pose any risk.