Can the app record my internet browsing and send it to an outside source?
It may depend on which browser you are using. The stock browser should save it's browsing history within its private storage. If there is no root exploit, an external app should be unable to access the browsing history.
Can the app upload to an outside source photos that I have taken?
If the app requests and gets granted the write external storage permission, it would be able to access your photos. Then it would only need the Internet permission, to upload these photos so some site.
Can the app look at data from other apps and use it?
Usually not. But again, if there is a root exploit available for your Firmware version, it could use it to access every piece of data on your Android device.
Are there particular app permissions which are rare requirements that might indicate a malicious app?
Well, it depends on what the app should do and what permissions are requested. Most Apps that could also run offline, request the Internet permission for Ads. Contact the App developer if you are not sure why the App needs/requests a particular permission. I would be careful with permissions that could also cost you money: Send SMS and Call Phone. I've heard that some strange social network app requests now send SMS for some reason.
Also the READ PHONE STATE AND IDENTITY is pretty common, because it's needed for backwards compatibility with older Android versions. But it allows the app to read for example your IMEI, which is unique to your device.