Yeah, I'd of assumed this would of not been allowed by the JVM hence the exploit somewhere.

Edit: Apparently the applet was signed, hence no exploit needed.