Does this mean that any JavaScript code can determine the client's local IP addresses? Then it can be used for identification, I think browsers should let the users white-list the sites which are allowed to use WebRTC.
It seems so. I was a bit surprised myself, but this data is taken from the info that browsers send to each other to determine the best path for P2P connection. The actual code for determining local IP is taken from http://net.ipcalf.com.