" OK, by chaining above techniques(session upload progress + race condition + PHP wrappers), we can get the shell back!"
RCE through LFI using PHP sessions variables