I changed the position of the $CGI::Disable uploads - and that had no effect. Then I checked - uploads aren't disabled by default, so I removed that entirely. I still have the same problem - empty files in the upload directory. I think I must be doing something dumb, but I just can't see it.

And yes, you are right about disabling strict - so I've changed my practice. :-)