Ah, okay... i only searched that page for "%malware_path%" and focused on that section, to answer Rick's questions. Later on i see they narrow down the actual location a bit better, to:
Where "%payload_filename%" is the important item we should destroy. So apparently the %malware_path% will be inside the browser's Resources folder (not externally in /Library as my example theorized).
