Any idea how the attacker is getting the browser to run an image, presumably in an <img> tag, as a java applet? Or maybe it only works if you view the image dir

Any idea how the attacker is getting the browser to run an image, presumably in an <img> tag, as a java applet? Or maybe it only works if you view the image directly and the browser decides it's an applet by sniffing the contents?