Steps to reproduce

1. Create following HTML file and upload to any of Confluence page.

   <script>
   alert("Cookie: " + document.cookie);
   </script>
   

2. Open the file on Internet Explorer 7.
3. Then, you will see the javascript in that HTML file executed automatically.

Issue happens with IE9,8,7 with Confluence 3.5.

Firefox and Safari presents a download 'save as' dialogue box and does not render.