Firefox is open source software and can't be intended to do bad things, but the plugins, as I know, aren't open source. Can they be intended to do bad things? Is there any good idea to supervise them or to control their behavior?
I agree with the other answer about using NoScript, that's really the quickest and easiest ways to limit when executable web content is run.
If you want to really lock down your Firefox session in Fedora, you can use the
Chromium actually does a better job (IMO) of sandboxing plugins. On Fedora, the plugins run with a particular selinux context, and can only touch files in your home directory with the correct context applied, which limits their ability to "escape" and read other files on your disk.
Yes. They can do bad things. Addons from Mozilla's own site have some rudimentary review, but could still be dangerous. As the disclaimer you see when installing an add-on goes, only install extensions by authors you trust.
If you are using a system which supports SELiinux, like Fedora or Red Hat Enterprise Linux, the actions of the browser can be constrained, adding a layer of protection. However, by default, this doesn't do much, as people expect their browser to be able to save arbitrary files.
(Disclaimer: I work for Red Hat on Fedora.)