That's all fine and dandy until you start caring about IE support. Even in IE9 the support isn't there. So while the "mask a file input && target a hidden iframe" is pretty archaic, it is (surprisingly) robust, and not too hard to implement.
[Note] compatibility data from: (http://caniuse.com/fileapi)