More accurately and clearly, Firefox is the last remaining major browser to disallow navigation to a "data:" URI.

> Data URIs that render non-SVG images, PDF, JSON and plain text files will not be affected, as they cannot be used for phishing attacks.

Mmhmm? I'm skeptical about the PDF part.