Apparently so
"Objects" loaded with the OBJECT tag can include, in IE, ActiveX controls that have essentially no security restrictions--an ActiveX control is free to access your hard drive and anything else on your computer. That's one tag I went out of my way to suppress.
The current preview takes place only in the browser, and doesn't use the fancy filter, which runs only on the server. It wouldn't be feasible to rewrite the filter to work on your browser, but it should be possible to have the server run the filter without posting and present you with an official preview.