A weakness in the way Microsoft IE fails to handle double backslashes in Showhelp() allows for yet another way to locally execute files.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/33330/chmexec.txt
Source: https://packetstormsecurity.com/files/33330/chmexec.txt.html