In Firefox, use a plugin or extension to invoke "unsafe" APIs?

Firefox extensions can invoke privileged APIs (e.g. nsIProcess to start an external app) without bugging the user, for example this extension does it from the download window: https://addons.mozilla.org/en-US/firefox/addon/10902/

I need to do the same kind of thing, but from a UI on a web page. Can an extension provide a XUL widget (which calls the privileged APIs via a component module) that I can instantiate in the page DOM? Or do I need to write a plugin?

I believe this is what you're looking for: https://developer.mozilla.org/en/Code_snippets/Interaction_between_privileged_and_non-privileged_pages

As that page says, there are security risks involved with this, so be careful.