Firefox

It sounds like, from other articles, Chrome at least is blocking access to the local machine from non-local pages, which seems very much desirable.

Blocking access to the local machine across-the-board would be problematic, since one might want to browse stuff served by a local webserver.

I'd also add that I've been around network security for some time, have gone through a bunch of the RFCs and know some odd IPv4 addressing quirks -- I can tell you that 0177.0x1 will reach localhost -- but didn't know that a packet addressed to 0.0.0.0 would go to localhost. From another article, it sounds like other addresses that reach localhost had been blocked a long time ago.