It's 'the Web', i.e. a set of HTML pages with some CSS and JS, with access to a few newly developed APIs, like the one for dialing the phone, but running locally on the device, not remotely.

Does anyone know how the sandboxing works to allow a camera, gallery and dropbox app to access the same locally stored image files? Or for local contacts to be shared?

A media API is being developed (in co-operation with the W3C) to allow exactly that.

Further, apps will be able to request "trusted app" status to run with less cross ___domain restrictions.