I have this
<input type = "file" id = "fileinput" />
document.getElementById("fileinput").files = ;
/etc/passwd, for example, without the user knowing.
The one exception is that calling "reset" on the form will clear the file or filelist, but you can never add to programmatically.