I'm curious, could it be possible to implement a simple SMB listener in javascript and then send send "\\<my-ip-address>\my_virus.exe\" (encoded in base64) as orbit_exe_path?
I'm not sure about windows, but on all the un*xes I know you need to be root (or have the right capabilities) to create a port with number < 1024. So even if the browser doesn't enforce this, the OS should.