the temporary filename will not be what the user submitted (unless the authors of express are complete security dumbasses, which I strongly doubt)