Resources/frames/XHRs/etc from 'file://' might be blocked, but what about top-level redirects?

At the very least, user-initiated top-level navigations should bypass any policies. If you're out to cause mischief, you could just link to the dodgy path on forums/comments/etc – there'll always be people out there who are careless and/or clueless enough to click on it.