HelpViewer is an application and using WebView to show a help file.
You can see it simply by the command:
or using "help:" scheme:
HelpViewer checks whether the path of the url is in a valid help file or not. But we can bypass this with a double encoded "../".
The attached poc will pop up a Calculator.
Tested on macOS Sierra 10.12.1 (16B2659).
This bug is subject to a 90 day disclosure deadline. If 90 days elapse
without a broadly available patch, then the bug report will automatically
become visible to the public.