they can (and do) select the upload image from anywhere on their local system. The server retrievable values only indicate the filename rather than the path though.
subnote: trying to keep the image name the same as what it was called by the surfer is more awkward than useful and can result in overwritten files on your server. It is best to attribute a new server created name once the file gets to you.
I find it best to use mysql_insert_id and name the images exactly the same as an auto_increment field of the database