The file-open dialog for <input type="file"> is shown even for untrusted events.  As a result, it is possible to make a user click on one <input>:
- open the file-open dialog for another <input>, or
- open the file-open dialog multiple times.

Repro: See Step 2 in https://output.jsbin.com/duqodib
(Ignore the "v2" behavior in the repro, those are related to  Issue 772432 .)

Here is the code: https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/html/forms/FileInputType.cpp?rcl=db60e6825b2fd3832b36a959e71a33005632e218&l=152

I think we should allow only trusted events to open the dialog.