It happened again:
Search for "C:/Users/User/Desktop".
And another example:
Search for "C:/Users". It appears many times.
Sorry it's all from the Hebrew Wikipedia—that's the one in which I happen to examine weird edits most carefully ;)
This could be just users pasting these into the link dialog and expecting them to work, not realizing that the URL refers to something on their computer only. URLs like file:/// appear on Windows when you open something using the web browser, and file:///C:/Users/bars/Desktop/פרנציסקוס הקדוש מאסיזי ויקיפדיה.docx is technically a valid MediaWiki page name, with file being normalized to קובץ in Hebrew.
This is quite possible, but file:/// links are probably not useful in any case. (Maybe on some Intranet MediaWiki installations, but certainly not on a Wikimedia site.) The three slashes should... sound an alarm of some kind, even if they are technically valid.
Just to confirm, pasting the link into the link inspector considers it valid, so it's not implausible that this is how it's happening.
I don't think we currently have a way to signify "this _is_ valid, but might not mean what you want it to" in that inspector.
I think what happens is that we only switch to the external link tab if the protocol matches the list of allowed protocols in MW. What we should do is switch to external for any protocol, then validate the input against the allowed list, so typing file:// will come up as invalid, but it would soil be possible to switch to internal