File extensions can also be added to the upload type whitelist; they'll be normalized to types for the actual comparison, so only known extensions will work.
Only 3 of 16 cases pass on my dev box with default config. Ouch!