There are lot of third party Java-XML parsers available.U can use that to get the data from the coresponding tag and build the drop down.
The other option is to use XSLT to build the editor controls for the XML editor.
A properly configured application server won't let any application running in it directly access any file system resources that aren't on that application's context root (so inside its WEB-INF directory for a Java web application server, plus directories specifically specified in deployment descriptors) for security reasons.
Apart from that there's no difference whatsoever between file access from web applications and any other applications. be it XML files or anything else.