file_save_upload() is in file.inc, but we moved the file entity to file.module, so this function should be there too.
Similarly, there's a lot of token-related code in system_token_info() and system_tokens(), probably test coverage too. That also needs to move to file.module.