TYPO3 Core

there are many ways to shutdown a windows computer, sometimes even a manipulated bmp or wma file is enough.
SCNR ;-)

well, but this also works under linux :)
I recommend to block anything from upload that has the possibiliy to execute something. So the following files for example:
.php
.phtm
*phtml
.shtm
.shtml
.exe
.bat
.cmd
....

The problem is you CAN'T build a complete list of everything that can be executed - i.e. what if the server has mod_perl? or ruby? or ASP?

The problem should be solved by webserver configuration in either .htaccess or some other way that would prohibit executing ANYTHING in the user-uploadable directories.

" in either .htaccess or some other way that would prohibit executing ANYTHING in the user-uploadable directories." Why not just create an .htaccess as an option in the install tool that is enabled by default? I mean, it can not be hard to do that and it would avoid normal be users or even just FE users from uploading something with the contents 'system("format c:");' which is possible right now in many situations in TYPO3.