Found the following on a codeproject page, and adapted it:
<script type="text/javascript">
<!-- Start of script hiding
function __LaunchExe(ExePath)
{
var s = new ActiveXObject("WScript.Shell");
s.Exec(ExePath);
}
// End of script hiding -->
</script>
<body>
<h1>Launch EXE test</h1>
<p>This is only going to work on IE, on an actual PC.</p>
<!-- BEGIN block -->
<a href="javascript:__LaunchExe('C:\\Program Files\\Lisson Grove\\QBC\\qb4.exe')">Click here</a> and 'C:\Program Files\Lisson Grove\QBC\qb4.exe' ought to launch.
<p>Everything in the relevant zone (ie trusted sites) security options for ActiveX controls has to be enabled for this to work.</p>
<!-- END block -->
</body>
Limited to IE by ActiveX. Starts a shell control, and then gets the shell to exec the passed in path. In a real situation this would be a UNC network path available to all users.
This works fine in a normal web page using IE (6) providing all the relevant ActiveX security settings are set to enabled for the (local) zone. Need to find out if it will work in the SharePoint environment next. Can't see why it wouldn't since it is down to the client browser.
Could probably be made to work with Firefox as well as there is supposed to be an add-on that allows hosting of ActiveX controls.
A lot of people will say one should never do this type of thing on principle, bad practice, breaks security, limited to certain browsers etc, but the reality is that if one is developing for a closed system - one does what is necessary and desirable for the users.