Prevent extensions from using window.open() as a quick way to show the user
general, untrusted web content. Throw exception pointing out the 'right'
safe API to use. Still allows file: URLs and relative paths (which are by
definition file: too, and used by Debug > Run Tests).
Allow window.open() with about:blank too (one extenion is using this, and
it's generally useful for programmatically generated UI)
Merge pull request #8365 from adobe/pflynn/protect-window-open

Prevent window.open() from loading untrusted web content