The CVE statistics on Apache POI indicate only a single known vulnerability, which is of type "denial-of-service" and is expanded upon there: namely, a specially crafted document may make POI allocate tons of memory (that is, more than it already does normally). If such a vulnerability has been reported at all, then it means that behaviour of POI on hostile documents has been investigated; if no "local file inclusion" vulnerability was reported, then chances are that there is none.
If you want to be sure, you may download the source code and look for file access primitives (references to classes from
System.IO). Alternatively, you could run the parsing in a Chroot sandbox so that local files which may be read through the parser could only be those from the sandbox.
(I don't guarantee anything here. At least, though, POI being written in pure Java, it should not suffer from remote code execution vulnerabilities through buffer overflows or similar bugs that are, by definition, prevented systematically at the VM level. You still want to enforce some strict limitations on VM memory usage, though.)