This is a potential security issue.

If register_globals is on, then PHP magic variables (HTTP_GET_VARS, HTTP_POST_VARS, etc) can be faked by remote web users. This is particularly important in the case of HTTP_ENV_VARS and HTTP_POST_FILES, which the script author may expect to come from a local source.

e.g.

http://www.example.com/example.php?HTTP_POST_FILES[file]=/etc/passwd

All the variables in http://www.php.net/manual/language.variables.predefined.php should be protected from being set by GPC variables, presumably in php_register_variables_ex. (Some variables cannot be overridden because they are set later to the correct values, but this is not good to rely on.)

(Yes, I know you have added 'is_uploaded_files'. I think this should be fixed anyway.)