OK, I found a hack that works. First, open the window and add file://foo, which it allows (it doesn't allow file: or file:///). Then quit Classilla, edit prefs.js, and remove the foo, leaving you with
user_pref("capability.policy.maonoscript.sites", "sbg: about: about:blank chrome: file://")...