There are a few possible attack scenarios that I can think of..
Attacking the server:
As already mentioned, you can use PHP to open/read other files on the system that may give credentials, or lead you in the direction of other attack vectors.
Even though the upload vulnerability places the malicious file in a specific directory that may contain certain security features, this does not always prevent the malicious script from writing a new file into the parent directory.
You can use the script to see who it is being executed as, check the permissions of other folders on the system to see if they are writable by that user.
Another obvious attack would be accessing the database by method of scanning scripts and configuration files for credentials. With this database you may be able to crack the password, or compare it to a rainbow table if not salted.
If you are able to read and write to other scripts on the webserver, you could backdoor the code in hopes to gather the admin password in plain text instead of having to brute force the hashed passwords in the database.
Attacking the user:
One of the biggest concerns with this type of vulnerability is that you are able to execute code on the server as the server. This gives you access to the users cookies for that site, which can contain valuable information, possibly leading to a hijacked session.
There is also the threat of malware being spread by the site, phishing attacks, and any other sort of attack that targets the users trust in the site being legitimate.
There are obviously more ways in which you can attack the system with this sort of vulnerability. Much of the next phase in the attack will depend on the results of the information gathering you do at this point.
While not always true, its generally safe to say that if a script can be uploaded by an untrusted third party...the system is compromised. What you do at this point is just a matter of intent.