Mail Multiple Information Disclosure — Mozilla

As a privacy measure to prevent senders (primarily spammers) from tracking when e-mail is read Thunderbird does not load remote content referenced from an HTML mail message until a user tells it to do so. This normally includes the content of frames and CSS files, but CrashFr showed it was possible to bypass this restriction through indirection: the direct CSS or iframe src is included in-line, with that including remote content.