Lots of conflicting information on this one… Most pages will recommend using

netscape.security.PrivilegeManage.enablePrivilege("UniversalBrowserRead");
netscape.security.PrivilegeManage.enablePrivilege("UniversalBrowserRead");

Or go to about:config and toggle the setting for signed.applets.codebase_principal_support.
This didn’t do the trick for me, in fact it appears it is NOT required when you want to debug local files.
The only thing I had to do was create a file user.js under the FF profile directory (\D&S\user\App Data\Mozilla etc) with following content:

user_pref("capability.policy.XMLHttpRequestToAnySite.XMLHttpRequest.open", "allAccess");
user_pref("capability.policy.XMLHttpRequestToAnySite.sites", "http://localhost");
user_pref("capability.policy.XMLHttpRequestToAnySite.sites", "file://");
user_pref("capability.policy.policynames", "XMLHttpRequestToAnySite");

There is a security implication though. Any HTML file open from the hard drive will be able to communicate with any web site. Unfortunately I was not able to restrict the “file://” URL to a specific directory (like “file:///E:/html_projects” or something like that). Because of that I may have to keep coming back to this file and turn it off when I am done debugging. Or debug from the localhost server.