But even file type that you think it is pretty safe (jpg, wav and some other media foramt) can abuse parser bug in viewers / explore.exe to result in code execu

But even file type that you think it is pretty safe (jpg, wav and some other media foramt) can abuse parser bug in viewers / explore.exe to result in code execution. And how do you prevent the malware just name its .js as .jpg and execute it with some interpreter? Some interpreters definitively don't care about file extensions.