Images != attachments
If you talk about customavatars / customsignaturpics and these directories, that's a single directory.
Attachments or how VB calls it the "uploads" directory - there PHP is called to create a directory structure where the attachments are stored. When Safe Mode is enabled the user running those PHP scripts differs from the User the Webserver is running under so Safe Mode prevents file operations in these directories.
If the user running the PHP scripts doesn't differ from the use the Webserver is running under - let's call that user "dummy" and both PHP and IIS / Apache run as user "dummy" there're for sure other problems than storing attachments in the filesystem or the database.
Let this user own the PHP scripts - sorry - who's doing such stupid things should care about some much more important things first than thinking about where to store attachments.
So yes - feel free to show me how you can bypass Safe Mode - I'll even create a directory with a 777 directory but sorry if I won't change any user / group owners and activate PHP's chown / chmod / system and all the other calls nobody should have activated on it's server.