I think it fails because the player tries to load a file:// uri which implies using the filesrc gstreamer element. In this case the resource access is not verified at all on WebKit side.
For http uris our custom webkitwebsrc element does this check already.
I'll skip the test for now and try to work out a patch.
One approach to explore would be to use webkitwebsrc for file:// uris as well.
Created attachment 100490 [details]
Committed r90927: <http://trac.webkit.org/changeset/90927>