OK, I found a hack that works. First, open the window and add file://foo, which it allows (it doesn't allow file: or file:///). Then quit Classilla, edit prefs.js, and remove the foo, leaving you with

Then re-open Classilla, and you'll see a file:// entry. This matches file:/// paths, allowing local files to execute. Adding other URLs and quitting Classilla doesn't disturb this file:// entry.