I'm a bit late replying, but I wouldn't consider an application that allows users to upload files, and pick their names to be a sane application. Do you think imgur (as an example) lets users name their files? What about stuff like the defunct megaupload or other file sharing sites? You get to pick filenames but that's really metadata... the URLs and (presumably) the underlying file storage structure are database-driven.
Now all you need is a user who kindly requests for a copy of uploaded files. If you're not aware of this issue (and you must be "actively aware" i.e. watch out for it all the time) you can do something that shouldn't be possible.