I think i wouldn't be too difficult to create some fall-back variant, for example:
Create a default upload-session-url before the form is shown to the user, and add a JS event listener to the submit button.
If the user pressed the submit button you can store in JS that the form has been already submitted (to invalidate the old session-url) and if someone tries to re-submit it it will try to get new upload-url and then send the form. I'm sure you can use JS to stop the submit event, request for new url and then force the submit again via JS (at least I'm sure know you can do that in MooTools) to send it finally. User won't probably even notice the small delay when waiting for the AJAX request to finish. As I think about it you can also use synchronous request and then you don't event have to cancel the submit event .. :)
So if the user has JS disabled it will just send the contents to the first upload-url and if he hit back he is screwed but at least he has the possibility to actually use the upload form in the first place :D so he is not screwed so much ;) only his browser can screw him...