Yeah...this is really dangerous. I highly recommend using a file size limit AND a severe set of regex's to enforce a "legal" (meaning you define what is legal) filename.

It's really easy to implement from the link that was already provided, just be careful.