In need of xforms permission information a.s.a.p.

All,

Here's my situation.  I'm developing an in-house firefox plugin (which 
might possibly be turned into a xulrunner app) that is meant to use 
xforms to edit local xml files. (We have some non-technical people that 
need to enter information into files. We want to use xml as the file 
format but the non-technical people don't want to see markup/code. So 
providing a forms-based GUI using XForms seems like a great answer. As 
we develop new xml document types, it becomes quite easy to knock out a 
corresponding XForms document.


This needs to pull in existing xml docs (for example let's say there are 
multiple files based on my xml document type - sample1.xml, sample2.xml, 
etc).  I don't want to hard code the XForms instance to sample1.xml 
because the user needs to choose which file to open. I seem to remember 
Mark Birbeck from xport.net saying that XForms 1.0 didn't really have a 
way to do that and it was being discussed for XForms 1.1, so instead I 
tried setting it via the DOM and it works. =)

OriginallY I was trying to pull this off with an <xforms:upload> element 
(as it provides a filepicker) that had an xforms-value-changed event 
that would activate some script, but I was having problems with this 
approach. Based on that and some other reasons I switched to 
xpconnect/xpcom using nsIFilePicker instantiated in a toolbar that my 
plugin/xllrunner app provides.


This is probably a lot of extra work but here's what I'm doing. My 
plugin has a xul xpconnext/xpcom based menu and filepicker. It also 
loads in an XForms doc into xul:iframe.  The user chooses the xml file, 
and I try to set the src on the instance element in my xforms but I get 
a security error in my jsconsole - the XForms doc is coming from the 
chrome:// protocol and the xml file the user is choosing from their 
local hard drive is coming from the file:// protocol so Firefox says 
they are in different domains:


Security Error: Content at 
chrome://publisher/content/installed/XFormsGUI.xhtml may not load data 
from file:///C:/data/doc1.xml.


I can go into into Firefox's Tools -> Options -> Content (Tab) -> "Allow 
XForms to submit data to other domains" -  but...
1) This is for submitting data to other domains - how about pulling data 
(via <instance src="">).  Hopefully this controls that too.
2) It won't let me add "file://"  as an allowed site. I also tried 
"scheme:file", "file", and several other variations.

Is there any way to allow Firefox to use XForms from chrome:// and 
instance files from file://  ?

If there is, is there any way to do so automatically (An XPConnect/XPCom 
setting from the plugin chrome or something)?

Any help would be greatly appreciated. I'm trying to roll out a 
functional prototype soon.