I would like to offer my members the possibility to upload pictures. How do I do that in the most possible secure way, if we suppose I am using php as a module and apache as user?

I have mounted /tmp in its own partition as noexec nosuid (owner is root).

Should I create there a directory /tmp/phptmp with owner apache?

Validation of uploaded files is of course planned, using the exif function check imagetype.
Does someone know if the Postnuke Modules Pagesetter, Gallery and Photoshare do a thorough file validation to check if the file is really what the extension says it is? What about phpbb2?
Is it possible to have the php script parse the uploaded file to check if it contains a script or a program?
File validation is crucial in my opinion.

Is it advisable to have move_uploaded_file put the file into a directory situated "above" httpddocs (meaning it cannot be reached by URL)?

With the proper file ownerships, I should be able to switch safe mode ON.

What else can I do to enhance security on uploads?

Harden the kernel, a la grsecurity.net and/or SELinux, and add in an application layer IDS, which is what ASL does: http://www.atomicrocketturtle.com/subscribe.html

I cant recommend grsec enough for server environments, if you want to try rolling your own its available at grsecurity.net.