I am often dealing with attachments that cause asserts or browser crashes when clicked on. There is no way to see them. If I click on them directly or if I click on "Details", the html is rendered and causes whatever assert/crash it is supposed to trigger. This unsafe-by-default behavior is extremely unhelpful. Could we please change it?

You should rather download the HTML page and view its source in a text editor. Simply right click on the attachment link.

Dup-ing this bug against a 5 year old bug that last saw activity 3 years ago isn't really helping. This is an unsafe default behavior. It needs fixing. While I can use Safari for these cases, I filed this bug so I don't have to. People can inject unchecked HTML into bugzilla and trick others into viewing it. This is the wrong default behavior. Please change the default behavior to view source.

Patches are more welcome than complains. We are basically two main developers for Bugzilla, and there are around 2000 open bugs. We are not Firefox with tens of developers contributing to JS core code every day. And filing a dupe isn't going to make things go faster. You should know that. And I told you in comment 1 how to easily get the source code without having to open the attachment first.