In the correct environment, you couldn't do either. However, with the right browser and programing language exploits you can. You can even do it without having to have access to their computer directly, if you are on the same network and can sniff their packets.
The root of this is directory access. JavaScript, for instance, is not able to go outside of the browser's scope, but a language like Flash can and access other directories on your computer if you allow such actions. This is why you need to really pay attention to your computer's permission settings, especially in IE since your Windows directories get their permission settings from it.