Honestly, I've never relied on $_FILES['name'] when storing an uploaded file. I just always naturally assumed it was a bad idea, but I couldn't really justify it with a specific vulnerability I'm aware of. Generally what I've done is stored the file using some knowingly unique identifier such as an auto increment ID from a database or a checksum/hash, then store any user-specified filename in the database for presentation to the user... I can't say I remember reading this practice anywhere specific. It could just be something I stitched together based on other unrelated best practices.

A quick Google leads me to this: http://stackoverflow.com/questions/9923416/php-file-upload-security-keeping-the-original-file-name

I suppose one risk would be if a user was careless enough to let people upload into the doc root and accepted .php files... Something along those lines could lead to trouble. I'm unsure if there's any risks involved in exploiting specific limitations of certain filesystems or anything like that -- I would imagine that's not really a concern.