[underwater]

A custom protocol wouldn't strictly be necessary. You could have the browser tell the server the path of the dropped files then have the server instruct the native client to fetch and upload those files.

However the File object hides the full path from the JavaScript code for security reasons (see https://developer.mozilla.org/en/DOM/File). I assume most dropped files would contain the user's home directory and therefore account name in the path.