FULL PRODUCT VERSION :
java version "1.6.0_18"
Java(TM) SE Runtime Environment (build 1.6.0_18-b07)
Java HotSpot(TM) Client VM (build 16.0-b13, mixed mode, sharing)

ADDITIONAL OS VERSION INFORMATION :
Windows Vista 32 bit
Microsoft Windows [Version 6.0.6002]

EXTRA RELEVANT SYSTEM CONFIGURATION :
Netbeans 6.8 ,  java 1.6_18

A DESCRIPTION OF THE PROBLEM :
Java Web start docs state that "the URLs passed as arguments to all of the APIs were restricted to be URLs to resources listed in the jnlp file(s) of the running application.  This restriction is changed such that there are no restrictions for signed and trusted code, and the restriction on untrusted code is not that it be listed in the jnlp file(s), but only that it be from the same codebase."

Refer:
http://java.sun.com/javase/6/docs/technotes/guides/javaws/enhancements6.html

We have a signed app which downloads resources from the same codebase.
The resources are not listed in the jnlp file as they are determined dynamically based on customer needs.

This particular scenario works fine in 1.6.0_16 but does not work any more in 1.6.0_18 (we have not used any other scenario so it would be worth testing those too)


STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Try to load a resource using DownloadService.loadResource in java 1.6.0_18.  Ensure that the resource is not listed in the jnlp file and versioning is not enabled. (we suspect even if it is listed it will not work - please test this also).




EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
results should be as per spec

Refer:
http://java.sun.com/javase/6/docs/technotes/guides/javaws/enhancements6.html

JNLP Specification relaxation of requirements for the DownloadService API.

ACTUAL -
resources are not loaded we get a FailedDownloadException wrapping a FileNotFoundException


Release Regression From : 6u16
The above release value was the last known release where this 
bug was not reproducible. Since then there has been a regression.