OK, now someone put this in PDF readers, so that once they open the specified PDF file, but before they start reading and parsing it, they call "pledge" and lock out further file opens. (If this breaks Adobe WebBuy, so be it.)
The mupdf PDF reader has been patched to make use of pledge on OpenBSD.
An OpenBSD developer vouched for MuPDF's code quality on Schneier's blog. A combo of good code and use of OS mitigations is a good sign. Might try to switch to it soon.
The Enterprise world will continue to read their PDFs using Adobe remote management software independent of what OpenBSD does, the rest of the world is there already (browser PDF readers).
As if browsers aren't full of security holes... It would really be a good idea to split up the browser into separate executables that could each use pledge() (more or less like Chrome, but a bit more granular).
Chrome's model is based on OP, which is a high-assurance-style model. If interested in secure browsing, look up OP2 Web Browser and IBOS Illinois Browser OS. Gazelle from Microsoft is also interesting.
When I get time, Im going to straight up try and run one through the tools like Softbound or Code Pointer Integrity that CompSci is building. If performance hit isn't too high, then problem mostly solved.
Oh, and put this in Flash. All you get to talk to is the originating site. No local file access except Flash's local config and cache files, which can be opened before reading the .swf input.