Some websites use Active Directory authentication. If you visit one with Internet Explorer that runs in the same Windows domain as your computer is in, you'll automatically be logged in. This uses some form of HTTP-level authentication and transmits your domain, username and the computer's hostname. Your password is not transmitted; the browser only answers a challenge from the server and proves its identity that way.
Internet Explorer only sends this info (username, domain and hostname) after the server has sent a challenge as well as the domain, and the domain matches the client's domain. For example if the server advertises that it is running domain
Contoso and the user is also logged in to the domain
Contoso, then Internet Explorer will proceed with authentication and provide a username, domain, hostname and challenge response, where the challenge response is a password substitute.
If the domain does not match, for example the server advertises to belong to
Contoso2, the user will be prompted for credentials (username and password). If the users enters these credentials, the username will of course be sent to the server, together with your hostname. The password is still confirmed by a challenge, this is never sent. Note that even if you enter a blank username and password, your hostname will still be exposed! The only safe exit is the cancel button.
The only way to retrieve the username automatically, as far as I've been able to find, is by knowing the domain that the user is logged in at, and having the user use Internet Explorer. I suppose the domain name is often guessable, so high-profile targeted phishing might be possible. Then again, you can never retrieve the user's password automatically, merely the username and hostname, so I'm not sure how useful this is. Perhaps to make a targeted phishing attack even more personal.
Another method to obtain the username is by this ActiveX control:
Testing this in Internet Explorer 9, it gives two warnings. First of all a warning on the bottom of the screen that asks whether I want to activate ActiveX components on the page, and a second warning asks whether I'm really sure because it might be harmful. With some social engineering you might trigger the username this way... but there are probably easier ways.
Other browsers such as Firefox always prompt for a username and password when visiting such websites. I think this data is sent unencrypted, but I haven't looked that up. Best is to always use transport layer security (e.g. https) when performing any sort of authentication. But this kind of authentication is not automatic, so probably not relevant for your question.
Update: Something I forgot to address that you asked was whether the username can be exposed when selecting files with the
input type=file element. In short: no. Older browsers might do this, but in recent versions of Chrome, Firefox and IE9 I've tested it and none of them expose the full path. In Firefox you might notice the
Disclaimer: Much of the Active Directory stuff was simply tested, there might be mistakes. I have two domains here so that makes it easy to see the behavior with Wireshark when you log into either the own or the other domain. I used IE9 for the client, and Windows Server 2008 for the server. I also used another test server (php) based on this script: http://siphon9.net/loune/2007/10/simple-lightweight-ntlm-in-php/