Requires Symfony.
Silex, not Symfony, and better to rely on trusted library code than to reinvent the wheel and introduce vulnerabilities...
This comment is an example of the type of negativity that is unhelpful and creates the toxic atmosphere HN is renown for, and I believe you know that considering you posted with a throwaway.
Heroku does slightly more than stage and place apps, guys.
One cannot seriously consider this for anything except a proof that basic utilities like zip, netcat, supervisord and php can be scripted with a higher-level language to hack together something that somehow works.
That being said, I like this cool hack.
Is it possible to craft a zip file that will write data to parent directories, or an explicit path?
It doesn't appear to attempt to sandbox the uploaded code at all. This is obviously not meant to be exposed to untrusted parties.