Mailto: ?attach=~/ parameter allows including arbitrary files on disk
That's why I use web-based email (FastMail and Proton Mail personally) because I want email software to exist in the same sandbox as all websites I visit on the web.