The actual rules of which files a local html file may access are browser depended. Chrome is a lot stricter than other browsers. Firefox allows access to files in the same folder and down the folder hierarchy as far as I remember.
Ordinary people with little in-depth background knowledge may save a html file with a cooking recipe, a book extract, a travel guide, etc. to their home folder. They don't except such a document to be dangerous. Keeping that in mind, it seems sane, to prevent saved .html files from accessing other local files.
To quote someone on the referenced bug report:
who cares if a webpage can read your credit card numbers by blinding guessing filenames in your profile directory, it can't actually do anything with them if access to internet resources is properly restricted.
The condition in the "if" part is not met: The same origin policy does not apply to image files and scripts loaded via the script tag, to name just two examples. So a locally running JavaScript can leak information to a server on the internet by encoding it in an URL.
Especially saving to the home folder is problematic, because at - least on unix systems - there are well known files with sensitive information such as: mbox, .gnupg/secring.gpg, .ssh/id_rsa, .ssh/id_rsa.pub.
Providing an installationless local http server is a workaround for this issue.
