If it is a security issue, you will probably need to implement a custom dialog and actively filter for file types. No matter what pattern you have showing, the user can type a pattern into the dialog and get anything they want. In addition, file extension is not sufficient to determine file type. You should probably check the file itself to ensure it is an HTML file and does not have any embedded nastiness.
Fortunately, custom dialogs are easy to make. Using the event structure, you can filter inputs as well, so that only HTML files will be accepted. Good luck. Let us know if you need more help.