I've now worked out that the problem happens at the "_Addon=verify" stage, when the uploader tries to rename the completely uploaded temporary file from "uploading.{guid}.{filename}.resx" to "persisted.{guid}.{filename}.resx".
On another page in the site where I'm not using rewrites, things work fine, so I'm confident that permissions etc are all good. This is happening whether I use my previous UrlRewriting.Net rewrites, or my newer IIS7 'native' rewrites.
I've also enabled full IIS Failed Request Tracing, and have the FRT logs for affected requests; bizarrely, these show no problems and a 200 Status Code, yet Fiddler clearly shows a standard 404 response being returned to the uploader.
Help!
Phil