When I'm visiting a website on the public internet, the website can cause my browser to send requests to a local IP address (such as 10.0.0.1). This can be used to attack internal web sites, e.g., through CSRF attacks.
Why do browsers allow this? If browsers prohibited this, would this increase security? If browsers prohibited this, would it break sites, and how large would the impact be? Can we quantify the negative impact, or the security benefit?
Reference: see Jeremiah Grossman's comments in Browser Security Case Study: Appearances Can Be Deceiving, ACM Queue vol 10 no 10, November 20, 2012. He raised this question, and comments on two possible reasons, though the article doesn't quantify how many sites would be negatively affected by such a modification (to be fair, that was probably beyond the scope of the article).
Update: Apparently metro-style IE 10 enforces some restriction along these lines (see the section titled Private Network resources).