Hi folks, I've been reading a lot on the c99madshell, and have come to a very simple conclusion.  Scripts that take over your server and make it do inappropriate things can be often avoided by simply appropriately managing your file-upload capabilities within your web application.

That being said, here are a few pointers for you web-masters and requirements gatherers when it comes to file-upload capabilities.  Heed the warning, lest ye become like this Princeton site:

1. Are file-upload capabilities absolutely necessary on your site or web application?
2. If yes - then create a white-list of file types you want to upload (xls, doc, gif, etc)
3. Avoid allowing uploads of server-file-types (such as .jsp, .php, .html, etc)
4. Always save files uploaded outside the document root of a directory so they can't be immediately browsed (easily)
5. Virus-scan uploaded file content (think trojaned .gif files, or poisoned .pdf files)

There you have it.  A white-list combined with a black-list, some requirements-gathering intelligence added in for flavor, and plain old webmaster know-how, and you'll be invulnerable to most of thse drive-by file-upload-and-hack scripts like c99madshell and many, many others.  Now if your servers were all patched...