I know this is meant to mean anyone can read and write to that DIR but how would someone actually go about uploading a file to it or would they require the FTP account settings too?

Just cos the way php is being run means they only way it can create a file is if the folder is set to 777. I can put the DIR below the hosted root but was just wondering what the real threat is if I didn't do that .