Yes, does it not happen on remote urls?
aha. yeah. it sounds like you've uncovered a deficiency in our parsing of local urls. For HTTP urls permission is granted on a per domain basis. For file:// URLs, permission is granted using the full path (and unexpectedly, any get data as well).
a simple work around would be to set up a local server, in the meantime perhaps we can strip get data from file urls so that this doesn't happen.
best,
lloyd