It has to do with a new-ish "security feature" offering a new field in the header, similar to the issues with PDFs:
In Internet Explorer 8 Microsoft added a security feature to prevent
script injection vulnerabilities caused by buggy client software.
This feature is activated by a new HTTP header called
X-Download-Options which can be set to noopen. When that header is
passed with a file attachment Internet Explorer 8 will not provide the
option to directly open the file, instead you must first save the file
locally and then open it.
and, from http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx
Lastly, for web applications that need to serve untrusted HTML files, we have introduced a mechanism to help prevent the untrusted content from compromising your site’s security. When the new X-Download-Options header is present with the value noopen, the user is prevented from opening a file download directly; instead, they must first save the file locally. When the locally saved file is later opened, it no longer executes in the security context of your site, helping to prevent script injection.
HTTP/1.1 200 OK
Content-Disposition: attachment; filename=untrustedfile.html