I may be way off the mark (and no doubt others will point that out), but it seemed that the responses you got so far weren't really responding to your question.

I feel that way too: I don't feel like I'm communicating myself clearly. I got wicked explanations of GET vs. POST and great code snippets for doing the validation that I need. So, from a purely pragmatic point of view I'm all good.

The rub is, I still don't understand why this behaviour is observed. The docs say that upload will only return undef or a valid file-handle. I find that it returns a string rather than undef if I pass it a garbage filename. That wasn't expected behaviour. And, more confusing to me, the behaviour seems to change depending on whether I GET or POST it. Not understanding this bugs me! :)