Turning mod_security completely off for an upload script scares me. I had to do that for my plugin because most people don't have mod_security, but for those of you with mod_security you might want to consider some type of access control.
Instead of
<IfModule mod_security.c>
<Files async-upload.php>
SecFilterEngine Off
SecFilterScanPOST Off
</Files>
</IfModule>
Instead I would leave it on for everyone except me, and keep it on for everyone else. But actually if I was having this problem I would go and turn on debugging to find out the security rule causing this false positive and just fix that.
<IfModule mod_security.c>
<Files async-upload.php>
SetEnvIfNoCase Remote_Addr ^208\.113\.183\.103$ MODSEC_ENABLE=Off
</Files>
</IfModule>
While working on the AskApache Password Protect plugin I also had problems with the image media uploader. I found out that WordPress 2.5 is now using a small swfuploader.swf file which is a separate application than your browser. Javascript was my first guess but its definately connecting to your server from the flash application.
Which isn't a bad thing, just some unfinished action-script programming for the flash developer. So sounds like you guys are having a different problem than a HTTP Basic authentication one, so my guess is the flash app is using some sort of suspicious looking request in its communication with the server.
You can easily find out exactly what is triggering the mod_security rule by turning on logging. I blogged in some detail about how to do that on DreamHost.