Technically, a filesystem stores files as opaque sequences of bytes. There is no harm that the said bytes can do to your server as long as you do not try to "interpret" these bytes. Unfortunately, some operating systems are quite eager to interpret file contents, triggering heavy processing without explicit user consent; and that processing could have security holes exploited by maliciously crafted file contents. See this answer for details. Usual countermeasures apply: if you use a maintained OS (like CentOS) and apply published security fixes on a daily basis, then you should be fine. I would still recommend avoiding exploring the directory with a graphical file explorer, so as to avoid automatic interpretation of picture files.
Legally, any act of storing data coming from external sources can put you in trouble, depending on what the file contains and the legal framework in which you operate. When you have a mail server, it is rather unavoidable that you may receive just about anything by email, and most law systems will recognize that, as a technical service provider, you are not responsible for the email contents. It may still be worth talking to a lawyer, though, in particular if you envision creative storage systems. There can be privacy issues, too; you'd better protect access to the storage system for attachments as well as you would protect mailboxes themselves.
Note that safe email handling is not easy; it is considered bad form to lose emails when a badly timed power shortage occurs. Email sending systems are supposed never to physically destroy email data until the receiving system has duly announced that it has committed the email to a physical medium (which, in a Unix filesystem context, entails at least an fsync() call). If you split emails into their main body and separate attachments, then such handling becomes more complex; this is probably easier to do with a database than with a filesystem. Thus, I would recommend the database, not for security, but for reliability.
