If you want to write validation code like that by hand, using a custom validator, you can use the following function to get access to the iframe upload document:

function iframeDoc()
{
 var uploadManager = document.getElementById("<%=uploadManager.ClientID %>");
 var doc;

 if (uploadManager.contentWindow != null)
  doc = uploadManager.contentWindow.document;
 else
  doc = window.frames[uploadManager.id].document;

 return doc;
}

Change the uploadManager.ClientID reference to point to the ClientID property of the upload manager control on your page.

Using that, you can just call iframeDoc().getElementsByTagName("input") and filter through based on extension . Use a custom validator to encapsulate your validation code...