I am currently looking into Google Caja to run user-supplied JS code in the browser and in Node. So far, I understand, that, in a browser context, "cajoled code" disallows reading and messing with ...
The question is based on this issue in Chromium. It is marked as Won't Fix. Do you see any reason to block a local html file from accessing another local html file located in the same folder?