I just realised there is a shell: URI, but every search engine seems to think shell: and shell are the same thing.
The only thing I've found out is that you can type shell:startup right in explorer (XP & 7 tested) for obvious effects.
This is good already because there is no %startup%, but I want to know what else is this capable of.
Is there any MS reference on this?
EDIT (even if it's not on MSDN)
Stuart seems to have found a fairly thorough list of the folders; I'll speak to the mechanism behind it. The availability of this feature comes, at least in part, from the Url Moniker feature of Windows (I remember it as a feature of IE, but since they're integrated and all...): see http://msdn.microsoft.com/en-us/library/ms775149.aspx
You can register your own URL Monikers by implementing a COM interface for a moniker provider, and you can also have your app act as a client. http://msdn.microsoft.com/en-us/library/aa741006.aspx
You'll notice that at least some versions of the MSDN client use this feature, and some other old-school browser features like about:blank (which you can navigate to from the shell) depend on that mechanism as well. If I remember correctly, IE depends on wininet.dll's URL Moniker provider implementations to navigate to, for example, http and https sites. (gopher and a few other protocols were also implemented there). It's possible IE uses something more direct, though, as my memories of that era are rather hazy and I was not closely involved.