A researcher today unveiled an unpatched vulnerability in Internet Explorer (IE) that could allow an attacker remote access to victims' local files, but Microsoft downplayed its severity.