I have popups blocked as well, but Safari still allows the attachment window to open.

I think it does it because it knows I "requested" it to be opened.