This guy from Spi Dynamics (now HP) told me how you can get the local IP address in some browser / JVM combinations a few months back.
Click here to see if you are at risk.
Inside an applet, you seem to always be able to get the internal ip address using code like :
String strLocalIPAddress = (new Socket(strWebHost, intPort)).getLocalAddress().getHostAddress();
Go to see Lars Kindermann's MyAddress applet to check if you are at risk: http://www.reglos.de/myaddress/MyAddress.html
I also ran across a cool DNS Pinning applet/service that did port scanning. http://www.jumperz.net/index.php?i=2&a=1&b=9
Now add in CIFS / SMB into your dns pinned applet and ? ?