[laserbeam]

The problem is notepad itself would download and execute bad stuff if you click the evil link. If you would paste that same link in a browser you'd be ok.

And the problem is a notepad app is expected to be dead simple, have few features, and be hard to get wrong while implementing.

[graemep]

So Notepad will download and execute itself rather than launch an appropriate application to handle the URL? That was not clear to me.