Del manual:
Cita: $_FILES['userfile']['type']
The mime type of the file, if the browser provided this information. An example would be "image/gif". This mime type is however not checked on the PHP side and therefore don't take its value for granted.
Parece ser que es un valor que envia el navegador, con lo cual no es dificil de engañar.