The bizarre bug I was trying to figure out last week has been narrowed down. I believe the bug is in Mac OS X, not Apache. It has something to do with HTTP/1.1's keep-alive feature, which allows multiple requests to be made with the same connection; I suspect the implementation of this feature may have changed between Apache 1.3 and Apache 2.2, and that's why I never had the problem with 1.3.

The workaround is to add a Connection: close header on the page containing the upload form (not the page the form is submitting to). I don't know whether this will totally solve the problem, but since adding the header, I haven't been able to reproduce it. I've submitted this new information to Apple, and await their response. In the mean time, unless the problem recurs, I'm willing to consider the matter resolved.