There is no normal use case where a user can trigger this by simply uploading a file, but only if a malicious or malformed script attempts to inject the triggering filename querystring. We could simply return false, but I felt it more explicit to raise an error.