If your application rendered this as a page, it trusted the file extension instead of the contents. Sniff the magic bytes.
From the Pine & Birch edge-case pack: pine-and-birch.com/sample-files