I have a pretty good guess. They were using ShellExecute or a similar API with only "notepad” as a name or "edit" as a verb. The search order would end up finding your shortcut first. This would be odd behavior (the path should be be the full path and start at system32) but I don't have IE6 and Windows 95 to find the exact API lol.