Can another extension access memory in use or previously used by another extension?
@Noitdart covered this - yes.
Can another extension modify the code of another (eg, on disk)?
Again @Noitdart covered this but in case it's not clear, it would be possible to modify the code of another addon without requiring a restart. I.e. no disk is required to modify the code because the other addon has access to "executable" (interpretable) memory. By the same token, a malicious addon can modify any part of Firefox that it chooses to, either at run-time or through on-disk modifications to critical files.
The main mitigation of this risk (assuming you're not going to inspect all the add-on's code yourself) is that in answer to @georgie, there is a vetting process before an addon is allowed onto the official add-ons website.
Further security improvements are likely soon when Mozilla begin requiring all add-ons to be digitally signed before Firefox will load them. That's not going to help against a targeted attack but would give Mozilla an easy way to block execution of malicious add-ons/developers once a few unlucky people have discovered malicious behaviour in an add-on.
I don't think there is a risk of on-the-wire replacement of an add-on's code when it comes from Mozilla because they should be using TLS for all of that but I've not personally inspected their delivery system code. Again, the use of digital signatures will help protect against attacks relating to the malicious modification of an add-ons code during remote storage or delivery.
The other questions are a little less well defined but in addition to @Noitdart's explanation of add-on code execution scope some of the information below might be helpful.
Normally, Javascript in a web page is prevented from accessing the browser or addon code/data directly - it's remote code so can't be trusted. However, there are ways that a website can send simple data messages to an addon if that addon permits it. Before anything malicious at the system level can occur, it would need to be programmed into the addon code. So there is no such thing as strictly malicious interaction from the web page (assuming no security flaws in add-on or browser code) but there is a possibility of interaction which a malicious add-on may use as a trigger to do something bad.
Again going back to previous comments, because a malicious add-on can do anything it wants, it does not require any specific Javascript to exist in a targeted website (it can just add the malicious code into the site whenever it wants to).