I don't think we should support file protocol on the live service actually as it provides a way to read aribitary files off the filesystem (eg security.properties). I'm not sure that you could easily exploit this to get the output back in the browser, but it's not worth the risk.