As far as I know, from iOS SDK 3.2, file type handling is added and an iOS application can associate itself with some file type so that other applications can open this kind
Sndbox implemented over standard unix permissions control. All applications are stored in folders with unique name (actually, GUIDs), however owner for them is the same mobile:mobile.
So it looks like they just sends full file path to application which opens the corresponding file.