var extensionURL = "file:///Users/michaelkaply/Downloads/tabby_cat.xpi";
var policyPrincipal = Services.scriptSecurityManager.createCodebasePrincipalFromOrigin("file:///Users/michaelkaply/Downloads/");

try {
  Services.scriptSecurityManager.checkLoadURIStrWithPrincipal(policyPrincipal, extensionURL);
} catch (e) {
  alert("You shall not pass");
}