Depending on the browser and the settings, those can be from directly typed URLs, links that have been clicked, or pages that have been visited by any means (popups, etc.), or a combination of those.
The short answer is that if an address appears in the dropdown, it's been visited by the user, either on purpose or inadvertently. Malware may add addresses to the list or may redirect the user against his or her will to such sites.
Edited by Amazing Andrew, 20 October 2009 - 01:38 PM.