If I create a new node and upload fish.png which goes to the files directory another user also uploading a file called fish.png will overwrite my file.
The file is renamed, and an number is added to make the filename unique. When an uploaded file is saved, file_save_upload() indirectly calls file_create_filename(), which contains the following code.
if (file_exists($destination)) {
// Destination file already exists, generate an alternative.
$pos = strrpos($basename, '.');
if ($pos !== FALSE) {
$name = substr($basename, 0, $pos);
$ext = substr($basename, $pos);
}
else {
$name = $basename;
$ext = '';
}
$counter = 0;
do {
$destination = $directory . $separator . $name . '_' . $counter++ . $ext;
} while (file_exists($destination));
}