Faking PID 0 with a oneway Binder transaction, then a signed-int OOB write to rewrite the upload URL into an arbitrary file read.