The problem is actually in our extension of the uploader code, not in the original uploader. The template string is defined in lib/scripts/fileuploaderextended.js, line 80ff. This code is executed when the uploader is initialized and at least in a test with an alert I could get the HTML of the upload form that is replaced later. I've however no idea how we can easily filter out the elements we need, i.e. those that have been added by plugins and not by the core code. Maybe it is actually easier to implement
FS#2406 with a simple tab interface (or a button for switching) and a cookie setting that remembers the current tab so users can use the old uploader interface when they want to use plugins that use HTML_UPLOADFORM_OUTPUT. This isn't very different from what we've had before adding the new uploader as the flash uploader doesn't support any plugins, too. That way we also have a workaround for people that have problems with the new uploader because there are errors on the server side. If I've understood that correctly the uploader doesn't use the original form in any way, so we could simply create an empty div for the uploader and put this new div and the original form in a tab interface (or switch their visibility using a button).