It is. The most dangerous part though is when you can access files in the browser cache because scripts in file:// can read files in file:// (so all your files) and you can really easily put files in the browser cache.