I found that in Firebug I was able to put in just "history" in the console command line and it spit out an array of URLs. For example:
I thought that maybe this client object might allow you to get at those URLs, but it doesn't look to be the case. You can use the history object to move forward and back, but it doesn't seem to allow you to get at the contents of the array of URLs within it.
You may need to capture the URLs at the server side and store them in a user session var and then display them in your list box.