Could Firefox extensions access my passwords stored in Firefox? Are you using extensions working with your passwords ... to check your new mail by example?
AFAIK they're not isolated, i.e. running with the same privileges as the rest of XUL code, including Firefox UI itself. In the realm of a browser, I can imagine quite evil XUL extensions.<p>I cannot tell anything about the level of isolation for XUL runtime itself though - i.e. how protected the rest of your computer is from XUL code.