Direct uploading like this has not been possible through XHR as CORS support was only added this past year. However, you could mitigate it by handling the CORS

Direct uploading like this has not been possible through XHR as CORS support was only added this past year. However, you could mitigate it by handling the CORS headers through a proxy, using flash, or a couple other methods. You could, however, perform a traditional POST.