> Having the ability to control some of the content that is returned by the server in the response body is crucial for an RFD exploit to be successful.

This sounds like an XSS attack against downloaded files as opposed to rendered HTML.