Set up a configuration file in a well-known location that would allow the person installing the webapp to describe exactly what directory (or directories) may be browsed. You definitely do not want the user of the webapp to be able to browse any directory.
Then, you have the choice of either scanning the configured directories upon page load or in a separate thread. If in a separate thread, the webapp just needs to display the current contents of whatever list your back-end thread is keeping populated.
Use some kind of unique ID for each file. You should not use the file name, unless you are prepared to do all sorts of sanitizing and checking that the user of the webapp has not submitted a path to some other location on your server and that the characters in it are safe. A unique ID number would allow you to look up (in a Map, for example) what file the user wants to view.
Finally, displaying the file is as simple as reading/writing, but you should probably take a streaming approach rather than trying to read the entire file at once and then dump it over the connection.
If you are not planning to format the file, you should probably set the content type as "text/plain" (it will default to "text/html", which will likely not display properly).
If you want to format it, you'll need to figure out how to do that yourself.