I only have access to Windows XP, but looking at the picturespage.js source code inside nusrmgr.cpl (the control panel applet for users), it downloads images using this code:
EnumPics(top.window.GetShell().NameSpace(35).Self.Path + "\\Microsoft\\User Account Pictures\\Default Pictures");
The 35 (0x23) namespace is apparently ssfCOMMONAPPDATA .
The "Common App Data" path is [usually] C:\Documents and Settings\All Users\Application Data\ in XP and C:\ProgramData\ in Vista and later. This path can be obtained through the Windows API by calling SHGetKnownFolderPath using CSIDL_COMMON_APPDATA .
Boann source share