Just spotted this bit of news at the TechSpot.com

Do Notepad popups represent a security risk or are they simply another way for spammers & marketers to annoy us? Because of a design flaw in Internet Explorer, Notepad popup windows can be displayed from an HTML email message or Web page regardless of browser security settings. In addition, Notepad popups can access files on a hard disk, possibilly causing stability problems in a Windows system.