There are even other ways how you might be able to exploit this. I don't exactly know how Dropbox verifies if your file is already on the server. But if they only check a hash of the file it might be sufficient to know the hash of any file stored on Dropbox to gain access to the full file.

Of course, this is just a speculation and there might be more security precautions in place. Such as, e.g., sending the client various challenges about the hashes of particular byte ranges.

In addition, also the copyright implications of this are interesting. Consider that you've shared a directory with your friends and that you upload some copyrighted movie (that is already on their servers and not really uploaded). Are you then the one liable for the damages (if sued), or is the original (first) uploader of the file liable?