Firstly, a malicious website can fill up your hard disk using
localStorage (see FillDisk, be sure to click the "stop this madness" button before leaving the site. Or don't click that link and just see the explanation here). I don't think there have been any cases of malware being saved on a computer via
localStorage, since the data is stuffed into a small database.
Besides this, on Chromium/Firefox, a website can make you download and install an extension/userscript. You are asked for confirmation first, but once the extension is installed, it potentially has access to all your data on all sites (including passwords).
On Chrome, it is harder to force you to install an extension since you can only install via the Chrome Web Store, though someone may be able to bypass this via clever clickjacking.
Another thing JS can do is launch an application (like iTunes or Ubuntu Software Center) via a custom URL scheme, and if you have a downloader application (or something that can be used as one), this may be exploitable. This asks for confirmation though.
Aside from that, JS can't get EXEs/etc onto you computer.