Apparently, it’s basically unexploitable already, because Mozilla controls the whitelist and the checks involved. Users who haven’t added sites to their download whitelist are protected from this exploit. So they say, anyway.