A couple nitpicks:
 * In the preg_match() test, it uses trim($name). In the subsequent "$destination = ...", it uses basename($name). So the preg_match() isn't using the same thing as the $destination. (This means, eg, that one can actually wind up with a leading space in the final file name.)
 * The first two lines about $name are far removed from the "basename($name)" filter and I didn't notice it at first. Would be good to leave a comment (or maybe put all the filters in one spot -- eg "$name = trim(basename(CRM_Utils_Request::retrieve(...)))")