Clear internal value when <input> changes to type="file" state

Adds a "clear the internal value when the new `type` is `file`" step to the
"When an <input> element's `type` attribute changes state" algorithm.

Fixes https://www.w3.org/Bugs/Public/show_bug.cgi?id=27791 .

source

@@ -44393,6 +44393,19 @@ interface <dfn>HTMLFormElement</dfn> : <span>HTMLElement</span> {
    otherwise, and then set the control's <span data-x="concept-input-value-dirty-flag">dirty value
    flag</span> to false.</p></li>
 
+   <!-- This step is present for the sake of clarity and safety so that the previous internal value
+   can't be accidentally referenced while we're in the type=file state. This step's effect isn't
+   (or at least shouldn't be) observable by script, due to the #input-type-change and
+   #dom-input-value state machines. -->
+   <li><p>Otherwise, if the previous state of the element's <code
+   data-x="attr-input-type">type</code> attribute put the <code
+   data-x="dom-input-value">value</code> IDL attribute in any mode other than the <i
+   data-x="dom-input-value-filename">filename</i> mode, and the new state of the element's <code
+   data-x="attr-input-type">type</code> attribute puts the <code
+   data-x="dom-input-value">value</code> IDL attribute in the <i
+   data-x="dom-input-value-filename">filename</i> mode, then set the <span
+   data-x="concept-fe-value">value</span> of the element to the empty string.</p></li>
+
    <li><p>Update the element's rendering and behaviour to the new state's.</p></li>
 
    <li><p><dfn>Signal a type change</dfn> for the element. (The <span