Firefox built-in protection against allowing dragged non-image files can be bypassed when an executable is passed with a content-type of image/gif. Tested with Firefox 1.0 and Mozilla 1.7.5.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/36094/Firedragging.txt
Source: https://packetstormsecurity.com/files/36094/Firedragging.txt.html