But you do need the file to be stored locally. I don't think this attack is very serious. Downloading and opening files is already a risky maneuver.

My understanding of the article is there isn't a "local file" that matches the name, but the very act of checking for that filename causes the hang.

Happy to be corrected.

is this true for even evergreen browsers? Is this true for pages that's hosted in non localhost domain or drag n' dropped into browser from the file explorer? (file:// protocol)