If you didn't strip this, I bet most people will end up with something like:

$ ls
hello.txt
c:\upload\foo.doc
c:\temp\send.txt
etc...

:).. this is how CGI.pm gets the file name:

my($filename) = $header{'Content-Disposition'}=~/ filename="?([^\";]*)"?/;

lhoward did point out that some clients do send the full path. I need to look deeper into the CGI.pm source when I have an extra tuit.

Cheers,
KM