Okay, we have two issues here that have not been reported during the past year of development and testings:
1) Inserts to the admlog table need to have username sanitized; I'm moving the adminlog() function into the pp-inc.php and converting all the admin log entries to use this function as we sanitize the data before we insert it (including username). This is not an issue for most functions (like who's online) as we sanitize the username, but overlooked it in the admlog portion (probably because nobody testing ad a Moderator or Administrator had a ' in their username).
2) The PHP filename issue has two parts: the first part is making sure we fix the filename before checking to see if it already exists, which I have added. The other is the PHP issue which I hadn't heard of until today. Turns out this "bug" exists in PHP 4.3.10 but was fixed in 4.3.11.
http://bugs.php.net/bug.php?id=31398&edit=3
So, if this is a problem for you, based on what I have read so far I would recommend upgrading your PHP to version 4.3.11 to fix the issue as I'm not sure that we should code a workaround in for a very specific single version of PHP.