Don't download files with a .wma extension .
You can create "trigger" points in a .wma video to do basicly everything one can do with HTML .

So if a guy builds a webpage with a virus , then distributes a video with a "trigger" point to auto-load that webpage ...

Well I hope you have a good virus-scanner if you just watched that video .
The worst part : you can't disable these features in Windows Media Player .