Jelmer Kuperus has found a way to access a user's local harddrive via Acrobat Reader's ability to embed swf files. This opens the possibility to steal local files or cookies. As it is necessary to know the exact filenames he rates the risk only medium. More details and a demonstration can be found here.