[...trimmed text...]

But it must be a security flaw within the email program.

An email is just plain text until your email client does something to it (decode the attachment, view the email (possibly as HTML), execute t... Login to read more.