Looks like a file:// origins can just enter full screen without displaying the "Always allow / Exit fullscreen" prompt. A "This page is now fullscreen" prompt appears for a short while and then slides out of the screen.
If the page can synthesize or just hang on a user gesture for a long time, it can enter fullscreen without the user noticing.
<html>
<button id="btn">enter fullscreen</button>
<script>
document.getElementById('btn').onclick = function() {
document.body.webkitRequestFullscreen(function(){});
}
</script>
</html>
