Security Flaws in Safari

Security Flaws in Safari:
I came across this article by Nitesh Dhanjani. He claims that he found 3 security issues in the Safari browser.
Here is the list of reported issues:
1. Safari Carpet Bomb. It is possible for a rogue website to litter the user’s Desktop (Windows) or Downloads directory (~/Downloads/ in OSX). This can happen because the Safari browser cannot be configured to obtain the user’s permission before it downloads a resource. Safari downloads the resource without the user’s consent and places it in a default location (unless changed).
2. Sandbox not Applied to Local Resources. This issue is more of a feature set request than a vulnerability. For example, Internet Explorer warns users when a local resource such as an HTML file attempts to invoke client side scripting. I feel this is an important security feature because of user expectations: even the most sophisticated users differentiate between the risk of clicking on an executable they have downloaded (risk perceived to be higher) to clicking on a HTML file they have downloaded (risk perceived to be lower).
3. Issue disclosed due to high vulnerability
Source Article: http://www.dhanjani.com/archives/2008/05/safari_carpet_bomb.html