@EvanDotPro agreed, I was also wary of this. This is a response to several community members requesting the feature.

Like you mentioned, `.php` files under the docroot seems like the biggest threat. That alone makes me think the default setting for `use_upload_name` should be **false** instead of true (I'll make that change). A `warning` block in the docs to remind about using a safe target directory would probably be good to do as well.

Much thanks for the feedback!