A widget, out of the box, only has access to files that are inside the widget package (they live in a pretty thight sandbox), the object model can be extended (or you can also write an activeX control) to give them access to both files or the camera if you want, the only tradeoff is that you will not be able to submit it to the marketplace, however, if that is not something you are interested in doing then you can package your extension/ActiveX and the widget in a cab and deploy them that way (The marketplace cerification will fail for cabs that have widgets in them or widgets that have PE binaries in its package).
To wite an extension you just need a COM object that implements the IDispatch interface, once that is registered in the system you can have the widget host load it for you by adding the following registry key:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Shell\Widgets\ObjectModels\<ObjectName>]
"CLSID"="{GUID}"
and, from javascript just do
var myObj = widget.createObject(<ObjectName>);
