This is why Javascript is such a worry.

I've seen (and helped develop) some proof of concept hacks to get all sorts of data from a users computer.

So far the best is compromising a users Myspace page.

Another good one I have seen (not worked on this one tbh, just seen the demo) is a combination attack on Facebook and the users email address. It works for Hotmail, Gmail and Yahoo... so pretty much everyone. If your logged into Facebook and into your mail provider it can reset your password, change your mail and lock you out in under a minute.. all from YOUR computer.

I imagine Twitter would be fairly similar to effect as well.