malicious wares - lemme into your mac.m4a

according to an apple security update, it's possible to hack into a mac by sending someone a malicious sound file. doesn't safari play these files in web pages without asking?