My guess as to why this hole is in IE is the following:
For browser-based FTP, you use: »ftp://myusername:password@ftp.mysite.com/somedir/, and MS was too hurried to fix it so it only worked on ftp. (maybe they figured you'd need it for some sort of http, too)
Just an explanation....still doesn't let ms off, though...
