It looks as though the URL in the inetloc file is `file:///bin/sh`. Running the command `open file:///bin/sh` should cause the same effect; Terminal.app starts

It looks as though the URL in the inetloc file is `file:///bin/sh`. Running the command `open file:///bin/sh` should cause the same effect; Terminal.app starts a new shell and executes `/bin/sh ; exit;`. Even if you managed to land an executable in the user's Downloads folder, and guess their username, I think there would be _multiple_ prompts the user would have to ignorantly click through.