There is one more case which is an imp one.
1> instead of using browse button, check whether the 
textbox is editable and user can directly the write the 
entire path of the file and the on click of upload button 
the file should get uploaded.
2> negative case for the above scenario is, write a wrong 
path or a path where no such file exits and click 
upload.here the system should give a message saying wrong 
path or no such file found.
3> also check if the upload functionality is only for 
authorised user, if mentioned in the specification.
4> on succesful upload, display a message the file upload 
successfuly.
5>when upload is in process the upload and browse button 
should be disabled, just to avoid clicking of those buttons 
when activity is in process.
6>Check if error handling is done , if the upload takes 
time then there should not be any error saying timeout.
7> also check in what time the file should be uploaded for 
the max size.
8>if upload is done to store a file on some server folder 
i.e server location, check same file with same filename 
should not be uploaded in the same location, or if its a 
databse then duplicate records should not be uploaded in 
the same tables.