I'm going to try and throw another issue into this discussion now too:
denial of service. We have discussed it for attacking remote servers, but
not for the client viewing the image. It's something else that I spotted
while I was playing around with this issue just now.
If you have images that include a mailto:me () my host somewhere com source,
then the default handler for mailto: links is opened up. Be that Outlook,
Netscape Composer, Eudora, or whatever else you care to use.
So if someone embedded 100 (arbitrary figure) mailto: images in a page, then
this would do a lot of harm to the user's computer. At best, it would get
very busy for a few minutes creating new emails, and would be a pain to
clear up. At worst, it could bring the whole system crashing down.