<< but HE can't see it, it can only be displayed locally. >>
BS. It is the same thing as saying that your forum post will not be displayed, because you type them locally. Nothing stops anybody from making simple form. In fact one can run submit() command and transfer file without you even knowing that!
As for bug being patched, install all recent updates and try it.
There is one way to fix it now - completely disable ActiveX. Oh, there is another one - uninstall windows!