Filing this based on bug 1136407. If we prevent the content process from accessing the profile directory, then we need to give it a way to access chrome: URLs. Otherwise, add-ons won't be able to load frame scripts. Jed, please dupe this if it's already filed. I couldn't find anything.

This bug is also affecting at least Mac but I don't know for Windows, so I refrain from changing platform to "all". Bugzilla offers not multiple choice option here.

Frame scripts are described here: https://developer.mozilla.org/en-US/Firefox/Multiprocess_Firefox/The_message_manager

I filed bug 1109293 for something similar with resource: URLs. In that bug I suggested that they resolve to the remoteopenfile: scheme instead of file:, to reuse the code that currently makes app:// work on B2G, but there might be a better way than that.