As pointed out by Makoto, this is exactly what you do when you send a person a trojan / virus. In general, files downloaded from the internet are not executed without warnings (jpgs are not executable anyway), and even so, a competent computer user will probably get suspicious.
Having said that, if you are the unstoppable kind and he is a close friend and who trusts you with his computer, I suggest that you recruit another friend to divert your birthday friend away from his computer and run the python script in the background.
It will be sure to surprise him and really freak him out, if its done right. It would be a good april fool's joke too.