If you are running your own WSUS server in a corporate environment, you should be able to download the updates and view the update files on the server. The update files are downloaded as a repository and you can choose when to push them (or whether to push them).
If WSUS itself doesn't provide a way for you to view the changes, you can open any .cab or .msi files in the update repository using various CAB extraction tools (hint, hint) and view the files within.
The easiest way to do this in my opinion is to have an "integration" environment where you deploy planned updates to a standard workstation image and see what impact they have on the filesystem and test out programs that your organization uses. This can either be on a spare workstation or in a virtual machine on someone's box.
During the update, you can run a tool like SysInternals Process Explorer to view which files are being written to, and just set up a filter that filters out things you don't care about like file reads and registry accesses.
Sorry if this isn't a direct answer, but I am not extremely familiar with running a WSUS server.