OK, got the flash uploader issue sorta' figured out.
In the plugin "Forum Display" for the product, find this line...
Code:
if((count($ib_intersection) == 0 || $is_visible == 0) && !(THIS_SCRIPT == 'postings')) {
... and change it to:
Code:
if((count($ib_intersection) == 0 || $is_visible == 0) && !(THIS_SCRIPT == 'postings' || THIS_SCRIPT == 'newattachment')) {
Note the addition of 'newattachment' as a THIS_SCRIPT identifier to skip removing of permissions.