Sure, it's just another application. For example, if there's a vulnerability associated with the way a web browser processes JPGs, it's possible that it would be just as vulnerable opening a JPG from the local disk as it would be loading one that's embedded in an HTML page (obviously, depending on how that specific vulnerability could be exploited).

There's quite a few browser exploits in Metasploit, along with one module that tries a lot of different exploits.

Set up a VM with e.g. IE5 or IE6 on an unpatched system, serve a client-side browser exploit with Metasploit, browse to the page with your vulnerable VM.  

Browser-exploits, targets the browser of course, but also Java, Flash, Image-interpreters, and sometimes custom extensions too. (And more.)

But as dynamik said, it is in essence just another application