As CodesInChaos notes, it will not be able to write outside of the Dropbox folder unless you execute it. Of course, if there were any directory traversal vulnerabilities in the client then this wouldn't hold true, but of the time of writing none have been discovered.
If you're concerned about running malicious files on a certain machine, then it would be better not to run the Dropbox client at all and simply use the web application to browse your Dropbox and shared folders. That way, Dropbox will not be able to write to your file system. It could be conceivable that an attacker who has the ability to execute files on a system, but not write them, could use Dropbox in order to get the files they need there. However, if this is the case then you're already partially compromised.
Using the web app as a browser will allow you to choose which files to write, although you still need to be careful you don't download and execute anything malicious. Using a virus scanner or end-point protection tools such as Cylance, Webroot or SentinelOne can help.
In case of others running malicious code that infects the shared folders, Dropbox includes a feature where 30 days' worth of changes are backed up, which you could use in order to restore all files to their pre-infected state. You may need to contact them though if there are a large number you wish to restore.