Even if it's just fstat and thus metadata it's a pretty remarkable turn of events. This would mean Dropbox would have access to a list of all the files on my computer, when I've last accessed them or when I've last written to them for example. I don't think this is something dropbox should do.

I agree that it's important to find out if they are phoning this information back home, because if they don't this is still very bad but a lot less harmfull.