Yeah - there's definitely something screwed up in the attachment display function. They seem to be getting uploaded and entered into the database correctly. The last security patch must have screwed something up, but it's late and I'm tired. I'll have to dig into it tomorrow.