The uploader inserts the file name directly into the page at the moment without handling any HTML special chars that may be in the name. This results in HTML that may be present getting rendered in error messages and the attachments list. This simply causes layout breakage for the user, since the backend takes care of sanitizing the name. Once phpBB returns the file data for the uploaded file, the name in the attachment list gets replaced by the one that phpBB provides.