Security of using uploaded file across two admin submits

I'm writing a plugin that merges two files, based on user input about which file to draw each section from. This means that I have to get the user upload and display it before I can get the user input for the actual merge.

My question is about the security and best practices for the uploaded file. Since I can't process it until the second submit, I can't just stick the name back in the form as a hidden input. It would have to be uploaded again. I can move the temporary file to a new name and put that name as a hidden input, but is that secure? I have no way to know if there is code in the file, although I make sure it matches a file extension and a 10 byte header, and of course the plugin is checking for 'manage_options' capability along with the nonce. Would it be better to put it in a cookie instead of a form field? I don't want to put it in the database, not just because of security, but because it limits it to one use at a time.