It's as good as anything else. Depending on how the client system is configured, checking the "_type" attribute of the uploaded file will probably get you something like:
"application/x-unknown-content-type-php_auto_file"
which won't be very helpful to you unless you want to scan for the "php" in it.
When your script processes the uploaded file, the file is placed in a temporary directory by default and your script must copy it to somewhere useful. When you do this, you can name the copied file whatever you want. Just don't name it with a ".php" or ".exe" or anything else dangerous.
-- Rich --
