Umm... Doesn't newattachment.php receive something like posthash or something of that kind that identifies whether what it's for? I am not sure, but when I did the "attachment in calendar" hack, I did something like that to distinguish between attachment that were intended for posts and attachments that were intended for calendar entries
EDIT:
Oh... I remember - the way I did it was I added a new field to the attachment table that identified where the attachment had to belong.. didn't use permissions for threads... I'm sure this can be done for PMs too