[noize]

I've just had a look yesterday and there are actually not. I spent pretty much time trying to edit the POST data with Tamper and no way to either get access to the root directory (not the one in the upload manager, 'cause files are actually saved in a subdirectory) or to upload shells or whatever. If you upload a PHP, ASP or whatever file it gets renamed to *.txt.