Yes, you could by running JavaScript in the browser. But although JavaScript in the browser has seen many improvements it is probably not the most efficient language to run these kind of algorithms in. The same goes for flash. Now Java applets could be seen already as a better alternative, but the age of Java applets (and possibly flash) is about over. Furthermore, many web browsers now detect ill-behaving scripts.
As dave_thomson_085 indicates in his comment bitcoin mining is now almost exclusively performed on specially developed bitcoin mining hardware. Usually bitcoin mining is not very productive on general purpose computers, even when the computers aren't actually owned by the person doing the mining. That JavaScript has horrible performance with regards to cryptography - compared to compiled languages with direct support for the underlying primitives - doesn't help here.
So I think DDoS attacks - that rely on the number of connections or the amount of data send (basically the bandwith of the upstream internet connection - are more likely applications for hijacked browsers. But yeah, you can use the resources that the host PC (to the script or application) makes available - of course.