You do have a point about security, Vulpix.
Yes, it's not enclosed in BBcode, so no use trying IEView anyway I guess. Hm, it would be trivial to get Bbcode via rewriting rules, e.g., in a scripting engine with even rudimentary regexp-like matching, if we had one. Or do we?
Come to think of it, we could also fence off security attacks by only matching specific filename patterns and feeding the file only to specific handlers anyway - let the jpg viewer "play" that exe file! I guess it won't look pretty, but it will do little harm.