Use file_exists to check for an uploaded file.

It turns out that stream_resolve_include_path doesn't work for a default
Windows install where upload_tmp_dir is set to C:\Windows\Temp. I'm
unclear if this is intended PHP behaviour or not, but the upload file
validator should not be checking for a file of the same name on the
include path regardless.
I think `is_file()` is more specific, because `file_exists()` also returns `true` when it is a directory. It looks to me using `file_exists()` creates a way for hackers to "scan" the system for specific folders?